Which versions of Cursor are affected by CVE-2026-48124?

Cursor Desktop prior to version 3.0.0 allows attackers to silently execute arbitrary commands on developer workstations through workspace configuration files, achieving complete system compromise…. A patch is available.

How to fix or mitigate CVE-2026-48124?

Within 24 hours: Issue security bulletin warning all Cursor Desktop users to avoid external or untrusted workspaces; isolate any systems that have opened third-party workspaces from sensitive networks. Within 7 days: Implement technical controls restricting workspace sources to internal repositories only; disable Cursor hook functionality in application settings if available; move Cursor-enabled systems to isolated network segments. Within 30 days: Conduct forensic examination of all Cursor-enabled endpoints for unauthorized hook entries in .claude/settings.local.json; monitor vendor advisory GHSA-pc9j-3qc2-95wv for patch release and deploy immediately upon availability.

Cursor CVE-2026-48124

Q: What is the CVSS score of CVE-2026-48124?

CVE-2026-48124 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-37002 HIGH

Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

2026-06-15 GitHub_M

Information Disclosure Cursor

8.5

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Malicious workspace file must reach the host (AV:L); no Cursor authentication needed (PR:N); victim must open the workspace and run an agent turn (UI:R); arbitrary local command execution yields full CIA on the user account.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 15, 2026 - 22:32 EUVD

Analysis Generated

Jun 15, 2026 - 21:52 vuln.today

DescriptionCVE.org

Cursor is a code editor built for programming with AI. In versions prior to 3.0.0, the Cursor Desktop could execute workspace-defined Claude hook commands from .claude/settings.local.json without dedicated user approval. A malicious workspace or agent-created file could configure hooks that run local commands in the user's context when an agent turn ends. This could allow sandbox escape, persistence across turns, local data access, or follow-on compromise. This issue has been fixed in version 3.0.0.

AnalysisAI

Unauthorized hook command execution in Cursor Desktop versions prior to 3.0.0 allows a malicious workspace to silently run local commands by registering Claude hooks in .claude/settings.local.json without prompting the user for approval. The flaw, tracked under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), enables sandbox escape, persistence, and follow-on compromise the moment an agent turn completes. No public exploit identified at time of analysis, but the vendor advisory GHSA-pc9j-3qc2-95wv confirms the issue and the CVSS 4.0 base score of 8.5 (High) reflects full CIA impact on the victim's workstation.

Technical ContextAI

Cursor is an AI-assisted code editor that embeds Anthropic's Claude agent and honors a project-scoped configuration file, .claude/settings.local.json, which can define hooks - shell commands that fire on agent lifecycle events such as the end of a turn. The CWE-829 root cause is that Cursor treated workspace-supplied hook definitions as trusted control input despite the workspace being attacker-controllable (a cloned repo, an agent-generated file, or a shared project folder). Per the CPE cpe:2.3:a:cursor:cursor:*:*:*:*:*:*:*:* the issue is product-wide across all Cursor builds before 3.0.0, regardless of host OS, because the hook-loading logic lacked a dedicated consent gate equivalent to the prompts used for other privileged actions.

RemediationAI

Vendor-released patch: Cursor 3.0.0 - upgrade immediately, since this is the authoritative fix called out in GHSA-pc9j-3qc2-95wv (https://github.com/cursor/cursor/security/advisories/GHSA-pc9j-3qc2-95wv). If an immediate upgrade is not possible, compensating controls include refusing to open untrusted repositories in Cursor and auditing or removing any committed .claude/settings.local.json from cloned projects before launching an agent turn (trade-off: developers lose legitimate per-project hook customization), and constraining the editor process with OS-level sandboxing such as macOS App Sandbox profiles or Linux user namespaces to limit what a triggered hook can touch (trade-off: may break tooling that relies on broad filesystem access). Organizations should also disallow agent runs on freshly cloned repositories until a manual review of any .claude/ directory has been performed.