High severity · published Jun 15, 2026
CVE-2026-48124
Cursor Desktop sandbox escape via Claude hook configuration
8.5
CVSS
0.1%
EPSS
No
On KEV
Description
Cursor is a code editor built for programming with AI. In versions prior to 3.0.0, the Cursor Desktop could execute workspace-defined Claude hook commands from .claude/settings.local.json without dedicated user approval. A malicious workspace or agent-created file could configure hooks that run local commands in the user's context when an agent turn ends. This could allow sandbox escape, persistence across turns, local data access, or follow-on compromise. This issue has been fixed in version 3.0.0.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CU
cursor · cursor
< 3.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-48124
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-48124
github.com
https://github.com/cursor/cursor/security/advisories/GHSA-pc9j-3qc2-95wv
More from cursor
9.9
CVE-2026-26268
Cursor sandbox escape via Git hooks
9.8
CVE-2026-50548
Cursor Desktop sandbox escape via agent-controlled working directory
9.8
CVE-2026-50549
Cursor Desktop sandbox escape via symlink and failed path canonicalization
9.8
CVE-2026-22708
Cursor has a Terminal Tool Allowlist Bypass via Environment Variables
9.8
CVE-2025-62354
Improper neutralization of special elements used in an OS command ('command injection') in Cursor allows an unauthorized attacker to execute commands that are outside of those…