Cursor's agent CLI patched an MCP OAuth flaw that let a malicious server execute code as you
Cursor published security advisory GHSA-wj33-264c-j9cq on October 2 for its agent CLI: when MCP was configured with OAuth against an untrusted server, an attacker could impersonate that server and return crafted, maliciously injected commands during the interaction, achieving command injection and arbitrary code execution on the host with the user's full privileges. It is tracked as CVE-2025-61591, rated 8.8 for command injection, and fixed in build 2025.09.17-25b418f for all affected versions. The National Vulnerability Database entry followed on October 3.
It was not an isolated case that week. CVE-2025-59829, also published October 3, covers Claude Code builds below 1.0.120: the tool failed to account for symlinks when checking its permission deny rules, so a symlink pointing at an explicitly denied file could still be read. Both bugs share a shape — the permission model of the agent harness, not the model, was the exploitable surface.
WHY IT MATTERS
An agent CLI runs with your shell, your filesystem and your network reach, so a prompt-injected tool call is equivalent to remote code execution and should be threat-modeled that way. Pin harness versions and treat auto-update as a security control rather than a convenience; treat every MCP server — especially anything reached over OAuth or added from a repo you did not write — as untrusted code with full user privileges; and put the agent inside a sandbox with scoped credentials and an egress allowlist. Verify deny rules against symlinked paths and re-read allowlists after every harness upgrade.

