Vulnerabilities & Exploits · Zero-Day Exploit

Cursor opens the repo, and the repo runs code

Cursor breaks the normal trust boundary at project open. A folder can carry a binary at the repository root, and Cursor will execute it as the signed-in Windows user just from loading the project, so the repository itself becomes the dropper.

Mindgard says Cursor looks for Git binaries in the workspace and will run a repo-root `git.exe` without warning or approval. The result is arbitrary code execution with the developer’s source, SSH keys, and cloud tokens still in reach, and the code can keep re-triggering as long as the project stays open.

That matters beyond one editor. Any tool that auto-discovers helpers from project contents can inherit the same failure mode, and seven months after the December 15 report Cursor still has no patch or advisory, with Mindgard’s latest confirmation landing on current builds.

3 sources · Jul 15

Timeline

• Jul 15 Reported by SecurityWeek
• Jul 14 Reported by Dark Reading

Sources

• Jul 15 SecurityWeek

  Unpatched Cursor Vulnerability Exposes Users to Code Execution

  An attacker can create a malicious repository containing a git.exe in the project root, and Cursor executes it automatically.

  original

• Jul 15 The Hacker News

  Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution

  Cursor runs a repo-root git.exe when a Windows project opens, enabling code execution as the user.

  original

• Jul 14 Dark Reading

  Cursor IDE Auto-Executes Malicious Code in Poisoned Repos

  Researchers reported the flaw to Cursor in December, but it still remains in the popular AI coding platform and can be used in poisoned repo attacks.

  original

Part of the PlainSec briefing for 2026-07-16

Every edition of this story: Cursor opens the repo, and the repo runs code

More from today

• AsyncAPI imports now trigger malware at load time
• Legacy shim revocations leave Secure Boot gaps
• Gold Eagle makes vulnerability triage a federal pipeline