↓ Skip to main content
Rony Utevsky | Security Research & Exploit Write-ups
Rony Utevsky | Security Research & Exploit Write-ups
  1. Research/

DeepJack: a 1-click deeplink RCE in Cursor via a lying MCP-install dialog

·2 mins·
Security Research AI Security DeepJack RCE MCP Cursor Deeplink Argument Injection Adversa AI
Rony Utevsky
Author
Rony Utevsky
Specializing in agentic AI security, LLM vulnerabilities, and secure code architecture.
Table of Contents

Executive Summary
#

Continuing the TrustFall and SymJack line of work on agentic coding tools, I looked at how these agents handle custom URL schemes. The result is DeepJack: a critical flaw in Cursor (through v3.9.8) where a single malicious cursor:// deeplink — delivered as an innocent-looking “please review this PR” message over email or Slack — achieves one-click, unsandboxed Remote Code Execution.

The trick is the same deception seen in SymJack: the approval dialog lies. It shows the user a harmless command while a hidden payload rides along, invisible in the prompt but fully executed once approved.

Vulnerability Risk Assessment: CRITICAL

  • Vulnerability Name: DeepJack
  • Affected Tools: Cursor (≤ v3.9.8); the deeplink/argument-injection pattern has broader implications for most mainstream coding agents
  • Vulnerability Type: Argument injection via custom URL-scheme handler leading to one-click RCE
  • Attack Vector: A crafted cursor:// deeplink phished via email, Slack, or any channel that renders links
  • Impact: Unsandboxed execution with the developer’s privileges — a direct path to SSH keys, cloud credentials, source code, and CI/production

How the Vulnerability Works
#

  1. Crafted Deeplink: The attacker builds a cursor:// URI that carries an encoded mcp/install command, nested inside a pr-review parameter using double URL-encoding to slip past validation.
  2. The Phish: The victim receives a message that looks like a routine code-review request and clicks the link.
  3. The Lying Dialog: Cursor opens its MCP install dialog. It renders the arguments in a single-line field showing a benign command (e.g. calc), while the real payload is hidden after tab characters, out of view.
  4. One-Click Execution: The user approves what looks harmless. The full command — hidden portion included — runs unsandboxed with the victim’s privileges, registering a malicious MCP server and executing the attacker’s code.

As with TrustFall and SymJack, the danger multiplies in automated pipelines: any surface that resolves deeplinks or auto-approves MCP installs turns a single click into instant credential and secret exposure.

Full Research and Details
#

For the complete technical breakdown, including proof-of-concept and vendor response, read the original publication:

👉 DeepJack: Cursor deeplink vulnerability — 1-click MCP server RCE (Published on Adversa AI)

🛡️ More in Security Research