{
  "entry": {
    "kind": "vuln",
    "slug": "ghostapproval-symlink-bypass-hits-claude-code-cursor-windsurf",
    "name": "ghostapproval-symlink-bypass-hits-claude-code-cursor-windsurf",
    "vendor": "Symlink Bypass Hits Claude Code, Cursor, Windsurf",
    "description": "Wiz Research disclosed GhostApproval, where a malicious repo plants symlinks that AI coding assistants fail to resolve before writing, so an approved write to a harmless-looking path actually lands on a sensitive system file, enabling RCE. It affects Amazon Q, Claude Code, Cursor, Google Antigravity, Augment, and Windsurf; at disclosure Augment and Windsurf had not shipped complete fixes.",
    "website": "https://gbhackers.com/ghostapproval-attack-impacts-amazon-q-claude-code-cursor-google-antigravity-and-windsurf/",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-07-09",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "ghostapproval-symlink-bypass-hits-claude-code-cursor-windsurf",
      "aliases": [
        "ti-050"
      ],
      "title": "GhostApproval: Symlink Bypass Hits Claude Code, Cursor, Windsurf",
      "summary": "Wiz Research disclosed GhostApproval, where a malicious repo plants symlinks that AI coding assistants fail to resolve before writing, so an approved write to a harmless-looking path actually lands on a sensitive system file, enabling RCE. It affects Amazon Q, Claude Code, Cursor, Google Antigravity, Augment, and Windsurf; at disclosure Augment and Windsurf had not shipped complete fixes.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Remote code execution",
        "Path traversal",
        "Sandbox escape"
      ],
      "componentType": "agent",
      "component": {
        "name": "Symlink Bypass Hits Claude Code, Cursor, Windsurf",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": "agent/cursor"
      },
      "affected": [
        {
          "range": null,
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-07-09",
      "modifiedAt": "2026-07-09",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://gbhackers.com/ghostapproval-attack-impacts-amazon-q-claude-code-cursor-google-antigravity-and-windsurf/"
        }
      ],
      "mitigation": "Update Cursor, Amazon Q, and Antigravity to patched builds and require canonical path resolution plus explicit approval before any agent file write.",
      "detectedByAnomity": true
    }
  }
}