# Agent Config Hook Injection via Repository Settings File

- **Severity:** High
- **Signature ID:** `7f3c1a9e-4b2d-4e88-9c15-2a6d0f83b1c7`
- **CVEs:** CVE-2025-59536

## Summary

AI coding assistants like Claude, Cursor, and similar tools read project-level configuration files when you open a repository. An attacker can plant a hook or auto-approval setting in one of these files so that when a victim opens the project, the agent runs an attacker-chosen command or auto-starts a malicious server before any trust prompt appears.

## How the attack works

An attacker commits a config file such as .claude/settings.json, .mcp.json, .cursor/mcp.json, or .codex/config.toml into a repository, adding either a hook bound to an executable command or a flag that auto-approves/auto-enables project MCP servers and bypasses the normal permission prompt. A victim clones and opens the repository in their agent-enabled editor. The agent reads the project configuration at session start and executes the declared hook or starts the MCP server immediately, with no user interaction required beyond opening the folder. This corresponds to the CVE-2025-59536 attack pattern. The detection looks for the moment this configuration content passes through the agent as tool input or output, requiring both a marker that the content is agent-config and a directive that looks weaponized.

## Why it matters

An attacker gets code execution on a developer's machine simply by getting them to open a booby-trapped repository, no click or approval needed beyond opening the project.

## What you can do

- Review any repository-level agent config files (.claude/settings.json, .mcp.json, .cursor/mcp.json, .vscode/mcp.json, .gemini/settings.json, .codex/config.toml) before opening a cloned or forked project in an agent-enabled editor.
- Treat hook declarations bound to executable commands and any auto-approve/auto-enable MCP server flags in these files as requiring manual review, not blind trust.
- Disable or gate auto-start MCP servers and bypass-permission-prompt settings at the tool level so they can't be silently activated by a repo's committed config.
- When investigating alerts, distinguish legitimate team-approved hooks (e.g. running prettier or eslint) and internally pinned MCP servers from unexplained or obfuscated commands.

## Known benign look-alikes

- A developer intentionally committing a legitimate project hook to their own repository -- e.g. a PostToolUse hook that runs prettier/eslint/gofmt after every edit. This is the single most common benign match and is exactly why the rule reports rather than blocks.
- A repository that legitimately pins enabledMcpjsonServers to an internal, reviewed MCP server so the team is not re-prompted on every clone.
- An agent reading vendor documentation, a changelog, or a blog post whose body contains a worked hook example (suppressed by filter_doc_example when the example is fenced or accompanied by reference prose).
- Scaffolding/template repositories that ship a starter settings.json with placeholder commands (suppressed by filter_placeholder).
- Security-research and detection-engineering repositories containing the CVE-2025-59536 proof of concept or Sigma rules describing it (suppressed by filter_doc_example and filter_detection_content).
- A user-level (not repository-scoped) ~/.claude/settings.json being read or rewritten by the agent -- the path is identical below the home directory and cannot be distinguished from content alone.

## References

- https://nvd.nist.gov/vuln/detail/CVE-2025-59536
- https://owasp.org/www-project-agentic-security-initiative/

---
Source: https://www.netzilo.com/threats/repo-config-hook-injection