Published Sunday, July 26, 2026 at 04:13 PM PT

<strong>CURSOR IDE — UNPATCHED ZERO-DAY ENABLES ARBITRARY CODE EXECUTION ON WINDOWS</strong>

BLUF: Cursor IDE contains an unpatched zero-day vulnerability on Windows that automatically executes a malicious git.exe file when a developer clones or opens a repository. An attacker can craft a malicious repository that runs arbitrary code during repository initialization. Windows developers using Cursor are at immediate risk. Immediate action: Do not clone or open untrusted repositories in Cursor until a patch is available. Use alternative Git clients (native Git Bash, GitHub Desktop, or command line) for repository operations on shared/untrusted sources.

DETAILS

  • Vulnerability mechanism: Cursor fails to validate the origin of the git.exe executable during repository operations. An attacker can place a malicious git.exe in a repository root or parent directories; Cursor automatically executes it instead of the system Git binary when opening the repository.

  • Disclosure timeline: Mindgard Research disclosed the vulnerability to Cursor in early 2026 and waited seven months for a fix. Cursor has not released a patch as of the latest reporting. The vulnerability remains unpatched in current versions.

  • Attack prerequisites: Requires the victim to clone or open a repository containing the malicious git.exe—typically via git clone or Cursor’s “Open Repository” feature. The execution is automatic and requires no additional user interaction.

  • Affected scope: Windows systems only. macOS and Linux are not affected by this specific vector (system PATH lookup differs). Scope includes all Cursor versions prior to an unannounced patch.

  • Confirmed by: Multiple independent security news sources (Latest Hacking News, SecurityWeek, The Hacker News).

IMPACT

Windows developers using Cursor IDE face immediate code execution risk. An attacker can:

  • Steal credentials or SSH keys
  • Exfiltrate source code or secrets
  • Modify repositories or commit history
  • Install backdoors or malware
  • Compromise the developer’s system and internal network access

Targeted attack surface is high: open-source projects, GitHub forks, shared repositories, and any untrusted source code.

RECOMMENDED ACTIONS

  1. Immediate (next 24 hours): If using Cursor on Windows, avoid cloning or opening repositories from untrusted sources until a patch is confirmed available.
  2. Workaround: Use native git clone from Command Prompt/PowerShell or GitHub Desktop to initialize repositories, then open the directory in Cursor (if needed).
  3. Monitor: Watch Cursor’s GitHub releases and security advisories for patch notification.
  4. Notify: Alert Windows developers on your team to avoid this attack vector; provide workaround guidance.

SOURCES

  • Latest Hacking News: “Cursor’s Unpatched Zero-Day Lets a Fake git.exe Hijack Any Windows Developer”
  • SecurityWeek: “Unpatched Cursor Vulnerability Exposes Users to Code Execution”
  • The Hacker News: “Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution”
  • Disclosure researcher: Mindgard Research (7-month embargo, no patch received)

STATUS: Unpatched. No CVE number or patch date announced.

Recent high-severity events at publish time:

Recent high-severity events