Threat
Is Cursor 3.29.15 exposed to the Chrome 0-day and VS Code MCP CVEs? - Support / Bug Reports - Cursor - Community Forum
First reported cursor.com
Page published
Earliest dated coverage: 11 Nov 2026 · First observed: 11 Nov 2026 · Latest dated coverage: 11 Nov 2026
Coverage timeline
Single-source incident — one report is available.
Why it matters
Malicious MCP-server notifications could expose AI coding environments to command execution, but defenders should distinguish upstream vulnerability reports from confirmed exploitability in Cursor.
A Cursor community report flags possible exposure in Cursor 3.29.15 to CVE-2026-120779, describing malicious MCP-server notifications whose clickable command links can execute VS Code commands. The report also flags Chromium CVE-2026-125350, but its Cursor assessment relies solely on bundled-version comparisons: no exploit reproduction was attempted, and Cursor-specific fixes or backports were not confirmed.