Cursor Desktop allowed workspace-defined Claude hook commands written in ".claude/settings.local.json" to be executed without user approval in versions before 3.0.0, creating a secondary code injection vector. This flaw permits an attacker to run arbitrary local commands in the user’s context when an AI agent turn ends, enabling sandbox escape, persistence across turns, and unauthorized access to local data. The underlying weaknesses are captured by CWE-829 (Privilege or Access Control Ignored) and CWE-94 (Code Injection).

The vulnerable product is Cursor Desktop, a code editor built for programming with AI, from the vendor Cursor. All releases prior to version 3.0.0 are affected; no specific sub‑version details are supplied besides the general “< 3.0.0” scope.

The CVSS score of 8.5 classifies this vulnerability as high severity, while the EPSS indicates an exploitation probability of less than 1%. It is not listed in CISA’s KEV catalog. The likely attack vector is a malicious workspace or an agent-crafted configuration file that embeds harmful hooks; the attacker must supply or orchestrate the opening of such a workspace. Once the agent completes a turn, the embedded commands run in the user’s context, enabling local code execution and potential compromise of the system.