What changed
Cursor published GitHub security alert GHSA-wj33-264c-j9cq on 2 October 2025. Cursor CLI builds before 2025.09.17-25b418f could suffer command bad command insert when MCP used login link against an untrusted server. A malicious server could return crafted commands during agent communication.
The security alert rates severity high with CVSS about 8.8. Patched versions start at 2025.09.17-25b418f. User interaction is required, but impact spans confidentiality, integrity, and availability on the host.
The flaw sits at the intersection of AI coding agents and tool plugins. MCP is becoming the default wiring layer for model tools across vendors.
Why it matters
Security teams already struggle to govern IDE extensions. MCP login link adds a network facing trust decision that developers may make casually when they demo a new server.
Command bad command insert through an agent can equal remote code execution with the developer user privileges. That is enough to steal keys, modify repos, or pivot inside corporate networks.
Who is affected
Developers using Cursor CLI with MCP login link, platform engineers standardizing agent tooling, and red teams testing AI supply chains. Security operations centers should hunt for unusual shell activity tied to Cursor updates.
What to do next
Force CLI upgrades to patched builds through MDM or package managers. Block login link MCP servers that are not on an approved list.
Add MCP servers to software inventory with owners and rotation dates. Run tabletop exercises on malicious server cases before you roll agents broadly.
What to watch
Parallel advisories for other agent products that embed MCP. Cursor release notes on hardening login link flows and server allow lists.
Industry guidance from CISA enrichment programs on scoring vulnerabilities in AI developer tools.
### Plain terms recap
This desk note covers a real public update from the last few weeks. We read the primary link first. We drop claims that sources do not support. Your next step should match your team size and risk level.
Save the source links in your team decision log. Pin the versions or configs named above. Map the change to access rules you already use for code, cloud, or lab systems.
If the update touches user data, run a quick review with privacy peers. If it touches money, health, or safety systems, test in staging before you change production.
Fast vendor releases often outpace internal policy. That gap feeds shadow use. Publish a one page guide so teams do not guess about allowed tools.
Watch the primary link for patches or scope changes. We will note major fixes in later desks if facts change.
Good briefs name who must act this week. They also name what signal would prove the story wrong or outdated.
Share this brief with your legal, finance, or ops peers when the story touches their systems. One short email beats a long slide deck for early alignment.
If you already run a weekly risk review, add this topic for five minutes. Ask what would break if you did nothing for thirty days.
When in doubt, run a one hour spike with two engineers and one security partner. Write down what you learned before you scale access.
Print the source titles in your ticket system so future you can trace why a decision was made. Future teammates should not rely on chat memory alone.
If a vendor fixes a bug, rerun your smoke test the same day. Small patches still change behavior in agent and cloud tools.
Keep a single shared doc with dates, owners, and links for each desk you follow. That doc saves time when audits or board questions arrive.
Photo: Tima Miroshnichenko / Pexels
Sources
- Primary — Cursor, CLI MCP login link security alert (2 October 2025). Versions affected and patch tag.
- Secondary — CISA, Vulnrichment project README (2025). Describes SSVC enrichment for public CVE records.
Related in Cyber Security
Continue reading