CurXecute: a Slack message rewrites Cursor's MCP config and runs code
In shortText planted in a public Slack channel made Cursor edit its own MCP config, which ran a command before the user could refuse (CVE-2025-54135).
What happened
Aim Labs showed that a prompt injection posted in a public Slack channel could reach Cursor when a user asked it to summarise messages through a Slack MCP server. The injection had Cursor write a new entry into its mcp.json.
The edit landed on disk and the new server started at once, even if the user rejected the suggestion: remote code execution as the user. Cursor fixed it in version 1.3, released on 29 July 2025.
Why it worked
Content an agent reads through a tool is treated as instructions. A config file the agent can edit is a way to run code.
What EndLayer shows or does
- Available now
The Guardian plugin in Cursor, whose controls include prompt injection, each with warn and block thresholds. Roadmap →
- Available now
Every MCP server declared on every device, with a risk tier; one that can reach a shell rates high. A new declaration shows up in the next report, every 15 minutes. Roadmap →
- Not covered
Stopping the config write itself; the fix is the Cursor update.