MCPoison

A high-severity remote code execution vulnerability in Cursor, the AI-assisted code editor, affects versions 1.2.4 and earlier. The flaw is in Cursor’s handling of previously trusted Model Context Protocol (MCP) server configurations at the project level. After a user approves a benign MCP server, Cursor binds trust to the MCP/plugin identity rather than to the exact approved command content. An attacker who can modify an already trusted MCP configuration file can replace the original harmless command with a malicious one, and Cursor will execute the modified command without presenting a new warning or consent prompt. The vulnerable condition can be triggered by changing the MCP configuration inside a shared GitHub repository on a branch the victim uses, or by locally editing the configuration file on the target system. This enables silent execution of attacker-controlled commands such as calc.exe and, more generally, arbitrary OS command execution.