{
  "schema_version": "1.6.0",
  "id": "ACVE-2025-0008",
  "aliases": [
    "CVE-2025-54136"
  ],
  "published": "2026-09-19T00:00:00Z",
  "modified": "2026-09-20T02:45:17.577Z",
  "summary": "Cursor can trust a mutable project MCP configuration",
  "details": "## What the vulnerability is\n\nCursor can trust a mutable project MCP configuration after a server has been approved. A repository can therefore present one server during approval and later change the configuration that Cursor uses. The affected harness range in this record is Cursor before `1.3.0`.\n\n## Which configuration is exposed\n\nThe exposed combination is Cursor with `harness.id` `cursor`, a version below `1.3.0`, and at least one MCP server whose lockfile `scope` is `project`. This is the ACVE proxy for a server launched from a project-scoped configuration such as `.cursor/mcp.json`. The matcher does not require a particular server package, transport, URL, or approval history; it only establishes that a project-scoped server is available to the vulnerable harness.\n\n## How ACVE detects it\n\nACVE reads `harness.id`, `harness.version`, and `mcpServers[].scope`. It cannot see whether the file was changed after approval, whether the repository is trusted, or whether the running server is the same program that was reviewed. A match is consequently a mutable-configuration warning, not proof that a server was replaced.\n\n## Fix\n\n1. Upgrade Cursor to `1.3.0` or later after confirming the release boundary.\n2. Treat project MCP configuration as untrusted until reviewed, and re-approve only a server whose command, arguments, and URL are unchanged.\n\nThe upgrade is the durable remediation; re-approval and repository review are compensating controls for the period before the fixed release is installed.\n\n## Grounding needed\n\n`acve advisory ground` must confirm the affected Cursor range and that `1.3.0` is the fixed release for `CVE-2025-54136`.\n\n## References\n\nSee `references` for primary sources.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "cursor"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54136"
    },
    {
      "type": "REPORT",
      "url": "https://example.com/research/acve"
    },
    {
      "type": "FIX",
      "url": "https://github.com/pickbitsai/acve/issues?q=CVE-2025-54136"
    }
  ],
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "8"
    }
  ],
  "database_specific": {
    "severity": "HIGH",
    "acve": {
      "specVersion": 1,
      "status": "published",
      "vulnClasses": [
        "mcp-trust-bypass"
      ],
      "cwe": [
        "CWE-829"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI03 Identity and Privilege Abuse"
        ],
        "atlas": [
          "AML.T0051"
        ]
      },
      "matcher": {
        "all": [
          {
            "field": "harness.id",
            "op": "eq",
            "value": "cursor"
          },
          {
            "field": "harness.version",
            "op": "semverRange",
            "value": "<1.3.0"
          },
          {
            "some": "mcpServers",
            "where": {
              "field": "scope",
              "op": "eq",
              "value": "project"
            }
          }
        ]
      },
      "fix": {
        "summary": "Upgrade Cursor to the confirmed fixed release and review project MCP configuration.",
        "actions": [
          {
            "type": "upgrade",
            "target": "harness:cursor",
            "to": "1.3.0",
            "why": "Use the fixed release."
          }
        ]
      },
      "exposure": "repo-controlled",
      "exploitation": {
        "vector": "malicious project or server configuration",
        "userInteraction": "required",
        "kev": false
      },
      "grounding": {
        "osv": {
          "checkedAt": "2026-09-20T02:43:25Z",
          "found": false,
          "aliasesConfirmed": [],
          "packagesConfirmed": [],
          "fixedVersionsConfirmed": [],
          "cvss": []
        },
        "nvd": {
          "checkedAt": "2026-09-20T02:43:25Z",
          "found": true,
          "cvss": 7.2,
          "published": "2025-08-02T00:15:25.290"
        },
        "kev": {
          "checkedAt": "2026-09-20T02:43:25Z",
          "listed": false
        },
        "registry": {
          "checkedAt": "2026-09-20T02:43:25Z",
          "confirmed": [],
          "missing": []
        }
      },
      "validatedBy": [
        {
          "who": "Mark Pickering (PickBits) via Claude Code session 01YR6ri2tM3jU9vdQNe9R5pw",
          "date": "2026-09-20",
          "method": "vendor-advisory",
          "evidence": "https://research.checkpoint.com/2025/cursor-vulnerability-mcpoison/",
          "note": "Cursor MCPoison, fixed 1.3.0 per Check Point; NVD CVSS 7.2."
        }
      ]
    }
  }
}