CVE-2026-48124: Cursor Desktop sandbox escape via Claude hook configuration

Synopsis

This is a sandbox-escape vulnerability in the Cursor Desktop code editor (versions prior to 3.0.0). The editor executed workspace-defined Claude hook commands from a local settings file without requiring dedicated user approval, meaning a malicious or agent-created workspace file could silently configure hooks that run arbitrary local commands in the user's context when an AI agent turn ends. Successful exploitation gives an attacker the ability to read local files, persist across agent sessions, and pivot to further compromise of the host system. HarborGuard tracks this advisory for patch availability, as no fix version has been published to package repositories at this time.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host, or the ability to place a malicious workspace file on the local filesystem; no network access to the target is required.

• AuthenticationNot required

  No account credentials or prior authentication are needed; placing or influencing a workspace-level settings file is sufficient to trigger hook execution.

• Victim interactionRequired

  The victim must open the malicious workspace in Cursor Desktop and allow an agent turn to complete, which triggers hook execution without a separate approval prompt.

• Attack complexityDetail

  Exploitation is reliable and condition-free once the malicious settings file is in place; no race conditions or special memory layout requirements apply.

Blast Radius

• Reads arbitrary local files accessible to the user's process context, including source code, credentials, and SSH keys.
• Writes or modifies files on the local filesystem, enabling persistence mechanisms that survive across agent sessions.
• Executes follow-on commands in the user's context, allowing lateral movement or installation of additional payloads.
• Crashes or disrupts the local development environment by terminating processes or corrupting workspace state.