Cursor Desktop Command Execution via Unapproved Workspace Hooks

Compliance Impact

The vulnerability allows execution of local commands without user approval, potentially leading to sandbox escape, persistence, local data access, or follow-on compromise. This can result in high confidentiality, integrity, and availability loss for the affected system.

Such impacts could affect compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and system integrity. Unauthorized local data access and potential compromise could lead to violations of data protection and privacy requirements.

Updating to Cursor Desktop version 3.0.0 or later, which enforces user approval and execution policy controls for workspace-sourced hook commands, is necessary to mitigate these risks and maintain compliance.

Useful 0 Not Useful 0

Executive Summary

This vulnerability affects Cursor, a code editor built for programming with AI, in versions prior to 3.0.0. The Cursor Desktop could execute workspace-defined Claude hook commands from a configuration file (.claude/settings.local.json) without requiring explicit user approval. A malicious workspace or file created by an agent could configure hooks that run local commands in the user's context when an agent turn ends.

This behavior could allow an attacker to escape the sandbox environment, maintain persistence across agent turns, access local data, or perform further compromise on the affected system.

The issue has been fixed in version 3.0.0 of Cursor.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts including allowing an attacker to execute arbitrary local commands on your system without your explicit consent.

Potential impacts include sandbox escape, which means the attacker can break out of restricted environments, persistence across agent turns, unauthorized access to local data, and further compromise of your system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Cursor Desktop to version 3.0.0 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the execution of workspace-defined Claude hook commands from the file .claude/settings.local.json without user approval in Cursor Desktop versions prior to 3.0.0.

To detect if your system is vulnerable, you can check for the presence of the .claude/settings.local.json file in your workspace directories and inspect it for any suspicious or unexpected hook commands.

Suggested commands to help detect potential exploitation or presence of malicious hooks include:

• Find .claude/settings.local.json files in your workspace directories: find /path/to/workspace -name settings.local.json
• Review the contents of these files for unexpected commands: cat /path/to/workspace/.claude/settings.local.json
• Monitor for unexpected command executions or processes spawned by Cursor Desktop, for example using system process monitoring tools like: ps aux | grep cursor
• Check recent file modifications to .claude/settings.local.json to identify recent changes: find /path/to/workspace/.claude -name settings.local.json -exec stat {} \;

Ultimately, the recommended mitigation is to update Cursor Desktop to version 3.0.0 or later, where hook commands require explicit user approval and follow execution policy controls.

Useful 0 Not Useful 0