PERMISSION/PROTOCOL
Back to incident tracker

2026-08-03

HighMedia report

Adversa.ai Identifies Two CVSS 9.8 Zero-Click RCEs in Cursor IDE and Deeplink MCP Server Hijack Vulnerability

Security researchers identify two zero-click remote code execution vulnerabilities in Cursor IDE and a deeplink exploit that installs malicious MCP servers.

CursorTool execution / MCPRemote code execution (RCE) and unauthorized configuration modificationDeveloper workstation running Cursor IDE

What happened

An attacker leverages a zero-click vulnerability or crafts a malicious deeplink that silently registers an external, attacker-controlled MCP server in the Cursor IDE, executing arbitrary commands on the developer's host.

Why it matters

Complete workstation compromise, potential credential theft, and unauthorized code execution in the developer's user context.

Missing authorization check

The Cursor IDE and MCP server registry must validate configuration changes and server installation requests against a trusted, cryptographically signed policy or user-approved external receipt.

Would PP block it?

Even if an attacker successfully exploits the CVSS 9.8 RCE or hijacks the MCP registry via a deeplink to execute arbitrary commands, they cannot generate the required PP-signed receipts for high-impact workstation actions (such as git pushes, credential access, or shell script runs). The PP enforcement layer runs independently of the Cursor IDE process and intercepts the execution stream, ensuring the compromise is contained.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-08-03

    Adversa.ai publishes its August 2026 security roundup disclosing the two CVSS 9.8 Cursor RCEs and the deeplink MCP hijack vector.

  2. 2026-08-03

    Researchers demonstrate a working proof-of-concept where a single web visit registers a malicious local tool server.

Technical breakdown

  • The zero-click RCE exploits a memory safety boundary during the parsing of specialized configuration and workspace files in Cursor.
  • The deeplink vulnerability enables handlers registered by Cursor to process `cursor://` URLs without confirming user authorization or origin validity.
  • An attacker-controlled website triggers the deeplink handler, which appends a malicious MCP server entry containing an executable path directly to Cursor's configuration.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Tool execution / MCP. The relevant Permission Protocol gate is Runtime Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Runtime Command Interceptor / Developer Workstation
Still needs
Vulnerabilities within the IDE's UI rendering engine or memory safety bugs are outside PP's scope.
Receipt required for
Registering new MCP servers, executing terminal commands, and accessing local developer credentials

PP's Runtime Gate blocks unauthorized shell execution and file modification commands even if the Cursor process is fully compromised via RCE.

Start small

Put the relevant gate at this action boundary.

This incident maps to Runtime Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop