[HIGH] Cursor MCP TOCTOU Persistent RCE (CVE-2025-54136)

Time-of-check/time-of-use flaw in the Cursor editor's MCP config handling lets an attacker silently modify an already-approved MCP config file and achieve persistent remote code execution without triggering a re-approval prompt. Demonstrated via a reverse-shell payload inserted after initial user consent.