CVE-2026-35603: Cursor Still Trusts a World-Writable Folder

The CVE-2026-35603 vulnerability affects four AI tools - Claude Code, Cursor, Codex CLI, and Gemini CLI - on Windows. These tools access machine-wide configuration from C:\ProgramData\, a folder that any standard user can write to. This allows an attacker to plant a hooks file there, which gets executed under every user who launches the tool, including administrators, without any prompt injection or elevation required.

The problem is that the tools read machine-wide settings without checking who owns the configuration file before loading it. They also have features that trigger commands based on routine actions. When a malicious file is placed in the vulnerable folder, it gets executed every time the tool is launched, even by administrators.

The vendors did not fix this issue by the time the vulnerability was published on August 11, 2026. Only Anthropic fixed it by moving the configuration out of the vulnerable path. The other tools still remain exploitable.

To mitigate the risk, users can manually create the ProgramData subdirectory for each tool and remove write access for the Users group. This prevents attackers from planting malicious files in the vulnerable folder. Users should also audit their systems for any existing vulnerable files and rotate sensitive credentials. The vulnerability is specific to Windows and does not affect macOS or Linux.