# CVE-2025-54133: DeepJack: One-Click Cursor Deeplink Installs an Attacker-Controlled MCP Server

> CVE-2025-54133 is a high-severity remote code execution issue in Cursor, a MCP server. Affected: Cursor 3.4.20 through 3.9.8 (unpatched at disclosure; no CVE or advisory issued).

- **Canonical URL:** https://catalog.anomity.ai/vuln/cve-2025-54133
- **Aliases:** ti-055
- **Severity:** high
- **Attack type:** Remote code execution
- **Component:** Cursor (MCP server)
- **Catalog entry:** https://catalog.anomity.ai/agent/cursor
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-07-15
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/cve-2025-54133

## Summary

Adversa AI showed that a crafted cursor:// deeplink can install a malicious MCP server and run commands under the victim's account after one click and one confirmation. Two tricks carry it. The MCP install dialog is a single-line text box, so tab padding pushes the malicious trailing command off the right edge where the person approving it cannot see it. And a second mcp/install URI nested inside a pr-review parameter is never recursively decoded, disguising the install as a routine code-review link. The primitive still fired months after the CVE-2025-54133 fix that was meant to surface deeplink arguments.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| Cursor 3.4.20 through 3.9.8 (unpatched at disclosure; no CVE or advisory issued) | no fixed version listed |

## Am I affected by CVE-2025-54133?

You are affected if you run Cursor 3.4.20 through 3.9.8 (unpatched at disclosure; no CVE or advisory issued).

## How do I fix CVE-2025-54133?

Allowlist MCP servers through managed settings so a deeplink cannot add one. Block install and execute deeplink URI patterns at the email and web gateway. Alert on any new or changed MCP server definition on a developer machine.

## How do I find every machine running Cursor?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Cursor and which version, then enforce a policy on it.

## References

- article: https://adversa.ai/blog/cursor-security-deepjack-deeplink-vulnerability-mcp-rce/
- cve: https://nvd.nist.gov/vuln/detail/CVE-2025-54133

## Related vulnerabilities

- [tensorlake-npm-sdk-0-5-144-compromised-by-a-shai-hulud-chaindrop-worm](https://catalog.anomity.ai/vuln/tensorlake-npm-sdk-0-5-144-compromised-by-a-shai-hulud-chaindrop-worm) — critical
- [ghostapproval-symlink-bypass-hits-claude-code-cursor-windsurf](https://catalog.anomity.ai/vuln/ghostapproval-symlink-bypass-hits-claude-code-cursor-windsurf) — high
- [CVE-2026-50548](https://catalog.anomity.ai/vuln/cve-2026-50548) — critical
- [agentjacking-public-sentry-dsn-hijacks-claude-code-cursor-codex-via-mcp](https://catalog.anomity.ai/vuln/agentjacking-public-sentry-dsn-hijacks-claude-code-cursor-codex-via-mcp) — high
- [trojanized-claude-code-extension-2-1-313-in-cursor-s-marketplace](https://catalog.anomity.ai/vuln/trojanized-claude-code-extension-2-1-313-in-cursor-s-marketplace) — critical
- [symantec-the-aoki-infostealer-now-takes-claude-codex-cursor-copilot](https://catalog.anomity.ai/vuln/symantec-the-aoki-infostealer-now-takes-claude-codex-cursor-copilot) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=cve-2025-54133