Loading story…
Researchers disclosed a Windows arbitrary code execution flaw in the Cursor AI coding IDE that causes the application to automatically run a malicious git.exe placed in the root of a repository when the project is opened. Mindgard said the issue stems from Cursor's Git path resolution logic searching the workspace itself for Git binaries, enabling attacker-controlled code to execute with the developer's privileges without clicks, prompts, or warnings; the payload may also be triggered repeatedly during normal use. In a demonstration, Mindgard renamed Windows Calculator to git.exe and showed Cursor launched it simply by opening the poisoned repository.
Mindgard said it first reported the vulnerability to Cursor in December 2025, later resubmitted it through HackerOne after contacting the company's CISO, and that the flaw was still present in Cursor version 3.2.16 as of late April 2026 and in the latest version it tested before publication. Cursor told Dark Reading it was addressing the issue. Until a fix is available, Mindgard urged developers to open untrusted repositories only in isolated environments and recommended enterprise Windows controls such as AppLocker or Windows App Control to reduce exploitation risk.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Cursor told Dark Reading it was addressing the reported issue. This vendor response came after public reporting that the flaw remained present in the latest tested version.
Mindgard publicly disclosed the Cursor vulnerability after months of attempted coordinated disclosure, describing how opening a poisoned repository can trigger automatic execution of a malicious git.exe with the developer's privileges. The disclosure included mitigation advice such as using isolated environments and Windows application control policies until a patch is available.
Mindgard states the issue was still present in Cursor version 3.2.16 as of April 30, 2026. According to the disclosure, the application continued to auto-execute an attacker-controlled git.exe from the workspace without prompts or warnings.
Mindgard says it first reported a Windows arbitrary code execution vulnerability in Cursor to the vendor on December 15, 2025. The flaw allows a malicious git.exe placed in a repository root to be executed automatically when the repository is opened.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcedarkreading.com
Open sourcemindgard.ai
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed two separate high-severity security issues affecting the **Cursor** AI development environment, showing how developer workstations can be compromised through both malicious repositories and rogue extensions. Novee reported `CVE-2026-26268` (CVSS 8.1), an arbitrary code execution flaw that can be triggered when a developer clones a crafted repository and Cursor’s AI agent performs routine Git actions such as checkout. The attack hides a malicious pre-commit hook inside a nested bare repository, allowing code to run locally without warning or additional user approval. Cursor worked with the researchers on a fix that was completed in February 2026, and defenders were urged to update to the patched version and inspect repositories for embedded bare directories and suspicious Cursor Rules files. A separate LayerX report found that any installed Cursor extension could access API keys and session tokens stored in a local SQLite database because the product did not isolate extensions from that credential store or use protected OS-backed secret storage. A malicious or compromised extension could silently exfiltrate credentials for Cursor services and third-party integrations including **OpenAI**, **Anthropic**, and **Google**, enabling account takeover, impersonation, data theft, and financial abuse. As of the report’s publication, LayerX said the extension issue remained unpatched and recommended moving secrets into encrypted system keychains and enforcing stricter extension isolation.
Jun 29, 2026
Researchers disclosed two critical vulnerabilities in the Cursor AI code editor, collectively named **DuneSlide** and tracked as `CVE-2026-50548` and `CVE-2026-50549`, that allow zero-click prompt-injection attacks to escape the IDE sandbox and achieve remote code execution on the underlying operating system. Both flaws carry a **CVSS 9.8** rating and affect Cursor versions prior to **3.0**, with exploitation enabling arbitrary file writes on a victim’s local system and potential compromise of linked SaaS workspaces. The attack chain abuses Cursor’s agent terminal command handling through working-directory manipulation and a symlink-based path resolution bypass, allowing attackers to overwrite the `cursorsandbox` helper and run arbitrary commands with the user’s privileges outside the sandbox. The issues were responsibly disclosed in February 2026 and fixed in Cursor **3.0**, released on April 2, 2026; while no active exploitation had been confirmed at publication, reporting warned the technique is highly automatable and organizations were urged to upgrade immediately and review any untrusted prompts or files processed before patching.
Jul 7, 2026
A high-severity vulnerability tracked as **CVE-2025-48384** affects Git’s handling of configuration values containing trailing carriage returns, creating a path for unintended script execution during submodule initialization. According to Armis, the flaw can be abused when an attacker can influence the relevant configuration context, potentially turning routine clone or submodule operations into code execution. Microsoft’s Security Update Guide also lists the issue, identifying it as a Git/GitHub vulnerability. Public exploit activity quickly followed disclosure, with multiple GitHub repositories publishing proof-of-concept material for **CVE-2025-48384**, including variants described as working over HTTPS and others explicitly labeling the issue as carriage-return-driven remote code execution on cloning. The appearance of several PoC repositories indicates that exploit details are broadly accessible, increasing the likelihood of weaponization against developers and build environments that process untrusted repositories or submodules.
Jun 29, 2026