{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2025-54133",
    "name": "CVE-2025-54133",
    "vendor": "Cursor",
    "description": "Adversa AI showed that a crafted cursor:// deeplink can install a malicious MCP server and run commands under the victim's account after one click and one confirmation. Two tricks carry it. The MCP install dialog is a single-line text box, so tab padding pushes the malicious trailing command off the right edge where the person approving it cannot see it. And a second mcp/install URI nested inside a pr-review parameter is never recursively decoded, disguising the install as a routine code-review link. The primitive still fired months after the CVE-2025-54133 fix that was meant to surface deeplink arguments.",
    "website": "https://adversa.ai/blog/cursor-security-deepjack-deeplink-vulnerability-mcp-rce/",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-07-15",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2025-54133",
      "aliases": [
        "ti-055"
      ],
      "title": "DeepJack: One-Click Cursor Deeplink Installs an Attacker-Controlled MCP Server",
      "summary": "Adversa AI showed that a crafted cursor:// deeplink can install a malicious MCP server and run commands under the victim's account after one click and one confirmation. Two tricks carry it. The MCP install dialog is a single-line text box, so tab padding pushes the malicious trailing command off the right edge where the person approving it cannot see it. And a second mcp/install URI nested inside a pr-review parameter is never recursively decoded, disguising the install as a routine code-review link. The primitive still fired months after the CVE-2025-54133 fix that was meant to surface deeplink arguments.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Remote code execution"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "Cursor",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": "agent/cursor"
      },
      "affected": [
        {
          "range": "Cursor 3.4.20 through 3.9.8 (unpatched at disclosure; no CVE or advisory issued)",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-07-15",
      "modifiedAt": "2026-07-15",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://adversa.ai/blog/cursor-security-deepjack-deeplink-vulnerability-mcp-rce/"
        },
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54133"
        }
      ],
      "mitigation": "Allowlist MCP servers through managed settings so a deeplink cannot add one. Block install and execute deeplink URI patterns at the email and web gateway. Alert on any new or changed MCP server definition on a developer machine.",
      "detectedByAnomity": true
    }
  }
}