# ghostapproval-symlink-bypass-hits-claude-code-cursor-windsurf: GhostApproval: Symlink Bypass Hits Claude Code, Cursor, Windsurf

> GhostApproval: Symlink Bypass Hits Claude Code, Cursor, Windsurf is a high-severity remote code execution issue in Symlink Bypass Hits Claude Code, Cursor, Windsurf, an AI agent.

- **Canonical URL:** https://catalog.anomity.ai/vuln/ghostapproval-symlink-bypass-hits-claude-code-cursor-windsurf
- **Aliases:** ti-050
- **Severity:** high
- **Attack type:** Remote code execution, Path traversal, Sandbox escape
- **Component:** Symlink Bypass Hits Claude Code, Cursor, Windsurf (AI agent)
- **Catalog entry:** https://catalog.anomity.ai/agent/cursor
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-07-09
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/ghostapproval-symlink-bypass-hits-claude-code-cursor-windsurf

## Summary

Wiz Research disclosed GhostApproval, where a malicious repo plants symlinks that AI coding assistants fail to resolve before writing, so an approved write to a harmless-looking path actually lands on a sensitive system file, enabling RCE. It affects Amazon Q, Claude Code, Cursor, Google Antigravity, Augment, and Windsurf; at disclosure Augment and Windsurf had not shipped complete fixes.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| see advisory | no fixed version listed |

## Am I affected by this vulnerability?

You are affected if Symlink Bypass Hits Claude Code, Cursor, Windsurf is installed or configured on a machine. Check the references for the exact versions.

## How do I fix it?

Update Cursor, Amazon Q, and Antigravity to patched builds and require canonical path resolution plus explicit approval before any agent file write.

## How do I find every machine running Symlink Bypass Hits Claude Code, Cursor, Windsurf?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Symlink Bypass Hits Claude Code, Cursor, Windsurf and which version, then enforce a policy on it.

## References

- article: https://gbhackers.com/ghostapproval-attack-impacts-amazon-q-claude-code-cursor-google-antigravity-and-windsurf/

## Related vulnerabilities

- [CVE-2026-50548](https://catalog.anomity.ai/vuln/cve-2026-50548) — critical
- [symantec-the-aoki-infostealer-now-takes-claude-codex-cursor-copilot](https://catalog.anomity.ai/vuln/symantec-the-aoki-infostealer-now-takes-claude-codex-cursor-copilot) — high
- [CVE-2025-54133](https://catalog.anomity.ai/vuln/cve-2025-54133) — high
- [trojanized-claude-code-extension-2-1-313-in-cursor-s-marketplace](https://catalog.anomity.ai/vuln/trojanized-claude-code-extension-2-1-313-in-cursor-s-marketplace) — critical
- [tensorlake-npm-sdk-0-5-144-compromised-by-a-shai-hulud-chaindrop-worm](https://catalog.anomity.ai/vuln/tensorlake-npm-sdk-0-5-144-compromised-by-a-shai-hulud-chaindrop-worm) — critical
- [agentjacking-public-sentry-dsn-hijacks-claude-code-cursor-codex-via-mcp](https://catalog.anomity.ai/vuln/agentjacking-public-sentry-dsn-hijacks-claude-code-cursor-codex-via-mcp) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=ghostapproval-symlink-bypass-hits-claude-code-cursor-windsurf