CVE-2026-48124

Cursor Desktop sandbox escape via Claude hook configuration

State: Published
Severity: 8.5 High
Published: Jun 15, 2026
Updated: Jun 16, 2026
Reserved: May 20, 2026

Description

Cursor is a code editor built for programming with AI. In versions prior to 3.0.0, the Cursor Desktop could execute workspace-defined Claude hook commands from .claude/settings.local.json without dedicated user approval. A malicious workspace or agent-created file could configure hooks that run local commands in the user's context when an agent turn ends. This could allow sandbox escape, persistence across turns, local data access, or follow-on compromise. This issue has been fixed in version 3.0.0.

Scores

CVSS	Score	Vector	Source
4.0	8.5 High	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-829 Inclusion of Functionality from Untrusted Control Sphere
CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

Product	Versions
cursorcursor	< 3.0.0Affected

References

https://github.com/cursor/cursor/security/advisories/GHSA-pc9j-3qc2-95wv

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.