ACVE-2025-0008

The configuration

Configuration label

cursor <1.3.0 + scope=project

Affected entries

• AgentHarness: cursor — SEMVER (introduced 0; fixed 1.3.0)

Matcher

• all
  • harness.id eq "cursor"
  • harness.version semverRange "<1.3.0"
  • some mcpServers
    • scope eq "project"

Why it is exploitable

What the vulnerability is

Cursor can trust a mutable project MCP configuration after a server has been approved. A repository can therefore present one server during approval and later change the configuration that Cursor uses. The affected harness range in this record is Cursor before 1.3.0.

Which configuration is exposed

The exposed combination is Cursor with harness.id cursor, a version below 1.3.0, and at least one MCP server whose lockfile scope is project. This is the ACVE proxy for a server launched from a project-scoped configuration such as .cursor/mcp.json. The matcher does not require a particular server package, transport, URL, or approval history; it only establishes that a project-scoped server is available to the vulnerable harness.

How ACVE detects it

ACVE reads harness.id, harness.version, and mcpServers[].scope. It cannot see whether the file was changed after approval, whether the repository is trusted, or whether the running server is the same program that was reviewed. A match is consequently a mutable-configuration warning, not proof that a server was replaced.

Fix

1. Upgrade Cursor to 1.3.0 or later after confirming the release boundary.
2. Treat project MCP configuration as untrusted until reviewed, and re-approve only a server whose command, arguments, and URL are unchanged.

The upgrade is the durable remediation; re-approval and repository review are compensating controls for the period before the fixed release is installed.

Grounding needed

acve advisory ground must confirm the affected Cursor range and that 1.3.0 is the fixed release for CVE-2025-54136.

References

See references for primary sources.

Underlying CVEs / aliases

• CVE-2025-54136

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Upgrade Cursor to the confirmed fixed release and review project MCP configuration.

Validation

Grounding

• OSV: not found; checked-at 2026-09-20T02:43:25Z
• NVD: found; checked-at 2026-09-20T02:43:25Z
• KEV: not listed in KEV; checked-at 2026-09-20T02:43:25Z

References

ADVISORY

• https://nvd.nist.gov/vuln/detail/CVE-2025-54136

REPORT

• https://example.com/research/acve

FIX

• https://github.com/pickbitsai/acve/issues?q=CVE-2025-54136