CVE-2026-35603: Writable ProgramData Lets Any User Hijack AI Coding CLIs (Claude Code, Cursor, Codex, Gemini CLI)

Summary

Cymulate disclosed CVE-2026-35603, a configuration-trust privilege-escalation flaw affecting four major AI coding CLIs on Windows: Claude Code (Anthropic), Cursor, Codex CLI (OpenAI), and Google Gemini CLI. All four load system-wide configuration from `C:\ProgramData\`, a directory that standard, non-administrative users can write to by default. By planting a malicious config file in an unprotected vendor subdirectory, a low-privileged attacker can have arbitrary commands execute inside the sess