Executive brief
Cursor is an AI-powered code editor used by developers to write and manage software. A vulnerability in versions prior to 3.0.0 allows a malicious project or workspace to automatically run unauthorized commands on a user's computer without their permission. This could lead to an attacker gaining full control over the user's local files, stealing sensitive data, or maintaining a permanent foothold on the system.
Technical details
A code injection vulnerability exists in Cursor Desktop due to improper handling of workspace-defined configuration files. Specifically, the application would execute hook commands defined in '.claude/settings.local.json' without requiring explicit user approval when an AI agent turn concluded. An attacker can exploit this by providing a malicious workspace or tricking an AI agent into creating a crafted configuration file. Successful exploitation allows for arbitrary command execution in the user's context, sandbox escape, and persistence. The issue is resolved in version 3.0.0, which implements mandatory user approval for workspace-sourced hook commands.
Affected products
- Anysphere (Cursor) Cursor Desktop < 3.0.0
Timeline
- 2026-05-21: advisory: GitHub advisory published by vendor
- 2026-06-15: disclosed: CVE published to NVD
- 2026-06-15: patched: Fix confirmed in version 3.0.0