title: Cursor MCP JSON Zero-Click Configuration RCE (CVE-2025-54136)
id: ATR-2026-00419
rule_version: 1
status: experimental
description: |
  Detects exploitation of CVE-2025-54136 in Cursor and the same-class issue surfaced by the OX Security MCP-by-design batch (2026-04-15) across Windsurf, Claude Code, Gemini CLI, and GitHub Copilot. The Windsurf zero-click variant (CVE-2026-30615) reaches the same config sink via attacker-controlled HTML content that the IDE renders, which silently writes the MCP JSON and registers a malicious STDIO server. The IDE's MCP config file (.cursor/mcp.json or equivalent) is auto-loaded on workspace open and treats the `command` and `args` fields as OS exec targets. An attacker who can modify this file via supply chain (npm package post-install, malicious .vscode/.cursor commit, repo template) achieves zero-click RCE the moment a developer opens the project. No prompt, no consent dialog.
author: ATR Community
date: 2026/05/04
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_llm:
    - LLM05:2025
    - LLM06:2025
  owasp_agentic:
    - ASI04:2026
    - ASI05:2026
    - ASI09:2026
  mitre_atlas:
    - AML.T0010 - AI Supply Chain Compromise
    - AML.T0040 - AI Model Inference API Access
  mitre_attack:
    - T1546 - Event Triggered Execution
    - T1059 - Command and Scripting Interpreter
    - T1195.002 - Compromise Software Supply Chain
  cve:
    - CVE-2025-54136
    - CVE-2026-30615
metadata_provenance:
  mitre_atlas: human-reviewed
  owasp_llm: human-reviewed
  owasp_agentic: human-reviewed
compliance:
  eu_ai_act:
    - article: '15'
      context: CVE-2025-54136 Cursor IDE auto-loads .cursor/mcp.json on workspace open and resolves the command field through child_process.spawn without consent dialog or integrity check, yielding zero-click RCE via supply-chain config tampering; Article 15 cybersecurity requirements mandate origin verification and explicit user consent for any AI tool that gains process-execution capability.
      strength: primary
    - article: '14'
      context: Article 14 human oversight requirements are violated when a workspace-bound MCP config triggers tool execution before any human-reviewable signal is presented.
      strength: secondary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (Cursor MCP JSON Zero-Click Configuration RCE (CVE-2025-54136)).
      strength: secondary
  nist_ai_rmf:
    - subcategory: GV.6.1
      context: Supply-chain governance under GV.6.1 must include integrity verification for any IDE / agent config file consumed at workspace-open time, since this is the canonical zero-click delivery vector.
      strength: primary
    - subcategory: MS.4.1
      context: Measurement subcategory MS.4.1 requires monitoring of tool-invocation events including the config-load event itself; CVE-2025-54136 exploits the absence of such monitoring.
      strength: secondary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Cursor MCP JSON Zero-Click Configuration RCE (CVE-2025-54136)).
      strength: primary
    - subcategory: MG.3.2
      context: NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Cursor MCP JSON Zero-Click Configuration RCE (CVE-2025-54136)).
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: Operational controls must require explicit consent and integrity verification for any AI-tool config file auto-loaded by IDEs / coding assistants, blocking the zero-click vector.
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Cursor MCP JSON Zero-Click Configuration RCE (CVE-2025-54136)) as a treatment control.
      strength: secondary
tags:
  category: tool-poisoning
  subcategory: zero-click-config-rce
  scan_target: both
  confidence: high
agent_source:
  type: mcp_exchange
  framework:
    - cursor
    - windsurf
    - claude-code
    - gemini-cli
    - github-copilot
    - any
  provider:
    - any
detection:
  condition: any
  false_positives:
    - Legitimate MCP setup documentation showing example .cursor/mcp.json layouts.
    - Open-source MCP server READMEs that include example config snippets for users to copy.
    - Internal team templates that include reviewed mcp.json fixtures with known-safe commands (npx + MCP package).
  conditions:
    - field: content
      operator: regex
      value: (?i)(?:\.cursor|\.windsurf|\.vscode|\.gemini|\.continue|\.claude)[/\\][^\n]{0,40}mcp(?:[_\-]?config)?\.(?:json|jsonc|yaml|yml)[\s\S]{0,400}"command"\s*:\s*"(?:curl|wget)"
      description: IDE-bound MCP config path co-located with a curl/wget command field within 400 chars — never a legitimate MCP stdio launcher (path mention alone is benign in docs)
    - field: content
      operator: regex
      value: (?i)\{[^}]{0,400}"mcp(?:Servers?|_servers?)"\s*:\s*\{[^}]{0,800}"command"\s*:\s*"(?:curl|wget)"
      description: MCP config JSON where command field resolves to curl/wget — those are never legitimate MCP stdio launcher targets
    - field: content
      operator: regex
      value: (?i)"command"\s*:\s*"(?:bash|sh|cmd|powershell)"[^}\]]{0,300}"args"\s*:\s*\[[^\]]{0,300}(?:https?://|\|\s*(?:ba)?sh\b|-enc(?:odedcommand)?\b|base64|iwr\b|invoke-webrequest)
      description: MCP config wrapper shell (bash/sh/cmd/powershell) whose args show a genuine payload marker (URL fetch, pipe-to-shell, base64/encoded-command). Excludes benign wrapper idioms lacking any such marker, e.g. 'cmd /c npx <pkg>' (standard Windows PATH workaround) or 'bash -c /absolute/path/to/own-built-binary --flag' (self-referential local launch).
    - field: content
      operator: regex
      value: (?i)"command"\s*:\s*"(?:npx|node|python|deno|bun)"\s*,\s*"args"\s*:\s*\[[^\]]*"-(?:c|e|-eval|-command)"
      description: MCP IDE config with interpreter + inline-exec flag — same flag-bypass class as CVE-2026-40933 but in IDE config scope
    - field: content
      operator: regex
      value: (?i)(?:zero[_\s\-]?click|workspace[_\s\-]?open|project[_\s\-]?open)[^\n]{0,80}(?:mcp|cursor|windsurf|claude\s+code|gemini\s+cli)[^\n]{0,160}(?:rce|exploit|malicious|compromis(?:e|ed)|silently|without\s+consent|no\s+consent)
      description: Skill content describing zero-click / workspace-open trigger AND an explicit attack-outcome word — plain 'on-open'/'config' co-occurrence alone was too generic (matched benign feature descriptions like 'the extension opens its own MCP settings JSON')
    - field: content
      operator: regex
      value: (?i)(?:postinstall|preinstall)[^\n]{0,80}(?:write|drop|create|modify)[^\n]{0,80}(?:\.cursor|\.windsurf|\.claude|mcp\.json)
      description: 'Supply-chain delivery: npm postinstall script writing/modifying IDE MCP config — zero-click setup'
    - field: content
      operator: regex
      value: (?i)(?:(?:compromise|tamper|inject)[^\n]{0,80}(?:\.cursor|\.windsurf|\.claude|\.vscode|\.gemini|\.continue)|drop[^\n]{0,80}(?:\.cursor|\.windsurf|\.claude|\.vscode|\.gemini|\.continue)[^\n]{0,100}(?:\{|"command"|mcpServers))
      description: Skill/document describing tampering with IDE-bound config dir. 'drop' alone is a common benign installation verb ('drop the folder into .claude/skills/'), so it additionally requires a nearby JSON-payload marker ({, "command", mcpServers) to disambiguate from ordinary install instructions; compromise/tamper/inject are unambiguous attacker framing and need no such gate.
    - field: content
      operator: regex
      value: (?i)no\s+consent\s+prompt[^\n]{0,160}(?:cursor|windsurf|claude|gemini|vscode|mcp\.json)
      description: No-consent-prompt property of IDE MCP config — narrowed from a bare 'auto-load'/'on-open' trigger (which matched ordinary feature descriptions like 'opens its own MCP settings JSON') to the specific, rarely-benign phrase 'no consent prompt'
response:
  actions:
    - alert
    - block_tool
  message_template: |
    [ATR-2026-00419] CRITICAL: Zero-click MCP config RCE pattern detected (CVE-2025-54136 + OX 2026-04-15 batch). IDE-bound MCP config (.cursor / .windsurf / .claude / .gemini / .continue / .vscode) resolves a shell or inline-exec interpreter as the command target, or content describes the workspace-open trigger pathway. Block invocation; require consent dialog on every new MCP server registration; treat unsigned MCP config files as untrusted.
confidence: 85