This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-48124 | BDVDB-2026-340435 Detail

cursorcursor

Description#

Cursor is a code editor built for programming with AI. In versions prior to 3.0.0, the Cursor Desktop could execute workspace-defined Claude hook commands from .claude/settings.local.json without dedicated user approval. A malicious workspace or agent-created file could configure hooks that run local commands in the user's context when an agent turn ends. This could allow sandbox escape, persistence across turns, local data access, or follow-on compromise. This issue has been fixed in version 3.0.0.

Impact#

Per CVSS v4.0: confidentiality impact high, integrity impact high, availability impact high. Attack vector: local.

Weaknesses#

  • CWE-829 Inclusion of Functionality from Untrusted Control Sphere
  • CWE-94 Improper Control of Generation of Code ('Code Injection')

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.
  2. Version 2Most recent update recorded in the CVE List.