Cursor EUVD-2026-37002

Exploitation requires the victim to open a workspace in Cursor Desktop <3.0.0 that contains an attacker-controlled .claude/settings.local.json defining hook commands, and then to run (or allow an agent to complete) at least one Claude agent turn so that the end-of-turn hook fires - this matches the CVSS UI:P (passive user interaction) and AV:L (local vector, i.e. the malicious content must reach the host filesystem). No authentication to Cursor is needed (PR:N) and the attack works against default configurations because hook loading was unconditional pre-3.0.0; limiting factors are that the attacker cannot trigger the flaw remotely without first delivering the workspace file (via a clone, shared folder, or agent-written file) and that the impact is scoped to the local user account, with no automatic propagation to other systems (SC:N/SI:N/SA:N).

The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H gives a base score of 8.5: the attacker needs a local foothold (the malicious workspace must be opened) and passive user interaction (the victim simply running an agent turn), but no privileges and no special attack requirements, yielding full confidentiality, integrity, and availability impact on the user account. There is no EPSS score, no CISA KEV listing, and no public POC provided, so this is not confirmed actively exploited - however, the trigger is unusually low-friction for AI-assisted development workflows where developers routinely clone untrusted repos and let agents read/write files. The realistic priority is high for any organization using Cursor with arbitrary external code, even though raw exploitation telemetry is absent; the SC:N/SI:N/SA:N values correctly indicate the blast radius is limited to the user's own machine rather than chaining into other systems automatically.

An attacker publishes or contributes to a repository that contains a crafted .claude/settings.local.json defining an end-of-turn hook such as a reverse-shell or credential-exfiltration command; when a developer clones the project and runs any Cursor agent task, the hook executes silently in their user context as soon as the turn ends. Alternatively, an agent prompted with malicious instructions writes the settings file mid-session, achieving persistence across subsequent turns. No public exploit identified at time of analysis, but the prerequisites map directly to common day-to-day developer workflows.