Vulnerabilities · 106 days ago

Cursor opens the repo, and the repo runs code

Cursor breaks the normal trust boundary at project open. A folder can carry a binary at the repository root, and Cursor will execute it as the signed-in Windows user just from loading the project, so the repository itself becomes the dropper.

Mindgard says Cursor looks for Git binaries in the workspace and will run a repo-root `git.exe` without warning or approval. The result is arbitrary code execution with the developer’s source, SSH keys, and cloud tokens still in reach, and the code can keep re-triggering as long as the project stays open.

That matters beyond one editor. Any tool that auto-discovers helpers from project contents can inherit the same failure mode, and seven months after the December 15 report Cursor still has no patch or advisory, with Mindgard’s latest confirmation landing on current builds.

CVE-2026-26268

NVD KEV

CVSS 8 HIGH: cursor is a code editor built for programming with AI. EPSS 0.7% (53rd percentile).

Timeline

Jul 15 Reported by SecurityWeek
Jul 14 Reported by Dark Reading

Sources

3 sources covering this story

SecurityWeek Jul 15
Unpatched Cursor Vulnerability Exposes Users to Code Execution
An attacker can create a malicious repository containing a git.exe in the project root, and Cursor executes it automatically.
The Hacker News Jul 15
Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution
Cursor runs a repo-root git.exe when a Windows project opens, enabling code execution as the user.
Dark Reading Jul 14
Cursor IDE Auto-Executes Malicious Code in Poisoned Repos
Researchers reported the flaw to Cursor in December, but it still remains in the popular AI coding platform and can be used in poisoned repo attacks.

Entities

CVE-2026-26268

Part of the PlainSec briefing for 2026-07-16

Editions

Vulnerabilities · 106 days agoCursor opens the repo, and the repo runs codeCursor breaks the normal trust boundary at project open. A folder can carry a binary at the repository root, and Cursor will execute it as the signed-in Windows user just from loading the project, so the repository itself becomes the dropper.Mindgard says Cursor looks for Git binaries in the workspace and will run a repo-root `git.exe` without warning or approval. The result is arbitrary code execution with the developer’s source, SSH keys, and cloud tokens still in reach, and the code can keep re-triggering as long as the project stays open.That matters beyond one editor. Any tool that auto-discovers helpers from project contents can inherit the same failure mode, and seven months after the December 15 report Cursor still has no patch or advisory, with Mindgard’s latest confirmation landing on current builds.