{
  "id": 3801294,
  "title": "CVE-2026-35603: Cursor Still Trusts a World-Writable Folder",
  "url": "https://urgent.news/2026/08/27/cve-2026-35603-cursor-still-trusts-a-world-writable-folder",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-27T18:49:05.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/c_k_fb750e731394/cve-2026-35603-cursor-still-trusts-a-world-writable-folder-34p9"
  },
  "original_language": "en",
  "account": "The CVE-2026-35603 vulnerability affects four AI tools - Claude Code, Cursor, Codex CLI, and Gemini CLI - on Windows. These tools access machine-wide configuration from C:\\ProgramData\\, a folder that any standard user can write to. This allows an attacker to plant a hooks file there, which gets executed under every user who launches the tool, including administrators, without any prompt injection or elevation required.\n\nThe problem is that the tools read machine-wide settings without checking who owns the configuration file before loading it. They also have features that trigger commands based on routine actions. When a malicious file is placed in the vulnerable folder, it gets executed every time the tool is launched, even by administrators.\n\nThe vendors did not fix this issue by the time the vulnerability was published on August 11, 2026. Only Anthropic fixed it by moving the configuration out of the vulnerable path. The other tools still remain exploitable.\n\nTo mitigate the risk, users can manually create the ProgramData subdirectory for each tool and remove write access for the Users group. This prevents attackers from planting malicious files in the vulnerable folder. Users should also audit their systems for any existing vulnerable files and rotate sensitive credentials. The vulnerability is specific to Windows and does not affect macOS or Linux.",
  "summary": "TL;DR Claude Code, Cursor, Codex CLI and Gemini CLI on Windows all load machine-wide configuration from C:\\ProgramData\\ , a folder any standard user can write to. Anyone with a normal account can plant a hooks file there and have their command run under every other user who launches the tool, administrators included. No prompt injection, no elevation, no warning. Anthropic fixed it and got…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}