Cursor Quietly Patches High-Severity Git Vulnerability After Seven-Month Delay

A cursor flaw goes unpatched for seven months. Image: Cursor

Cursor has patched a high-severity Windows vulnerability that allowed malicious Git repositories to execute code, highlighting security risks in AI coding environments.

Verfasst von

Joseph Ofonagoro

Jul 28, 2026

Opening a Git repository in a vulnerable version of Cursor could be enough to give attackers code execution on a developer’s Windows machine.

Security researchers at Mindgard discovered that Cursor would execute a malicious git.exe file planted in the root of a cloned repository, allowing attacker-controlled code to run with the logged-in user’s privileges. The company quietly patched the flaw roughly seven months after receiving a private disclosure, shortly before researchers made the vulnerability public.

Seven months after the vulnerability was initially disclosed, Cursor has silently patched it, just before Mindgard’s public disclosure of the issue.

Because AI coding assistants sit at the center of development workflows, weaknesses in how they launch trusted tools can expose developers during routine tasks such as cloning repositories. As these tools become more embedded in everyday developer workflows, longstanding security weaknesses such as untrusted search paths can have far greater consequences because the editor itself becomes part of the execution chain.

Details of the vulnerability

Mindgard, a cybersecurity firm, said it discovered the vulnerability last year and privately disclosed it to Cursor on Dec. 14.

The vulnerability stems from how Cursor handles Git files during project initialization. According to a Proof of Concept demonstration from Mindgard, as cited by Latest Hacking News, when calc.exe (Windows Calculator app) was renamed to git.exe, instead of validating that it was launching a legitimate Git installation, Cursor executed the git.exe binary from the root of a repository.

Mindgard reiterated the issue at Cursor’s HackerOne bug bounty program in January 2026, where the company confirmed the vulnerability. Still, nothing was done.

However, a report from TechTimes said that Cursor quietly fixed the vulnerability on July 13.

On July 14, seven months after the initial disclosure, Mindgard published the vulnerability. The firm stressed that full disclosure had become necessary to help organizations understand and mitigate their exposure.

The flaw is now tracked as CVE-2026-63093 and carries a CVSS severity score of 8.8 (High). It affects Cursor for Windows version 3.2.16.

Must-read security coverage

Why this flaw matters

While the vulnerability itself is dangerous, what’s more worrying is how simple it is to fall victim to it. According to Mindgard, the vulnerability “does not depend on a complex chain of exploitation, prompt injection, model manipulation, jailbreaks, memory corruption, or sophisticated attacker tradecraft.”

All a developer needed to do was open a Cursor project containing a malicious git.exe file in the repository’s root directory. Because developers routinely clone repositories from various sources, the exploitation of the vulnerability fits naturally into an everyday workflow without requiring unusual user behavior.

Additionally, developers don’t just write code; their machines often house proprietary technologies, sensitive files, credentials, and deployment secrets. Beyond the immediate compromise of a workstation, an attacker who gains access to a developer’s environment could tamper with software before it reaches customers, turning a single compromised machine into the starting point for a wider software supply chain attack.

That is why development platforms have become increasingly attractive targets for attackers. As AI coding tools such as Cursor take on more agentic coding tasks, longstanding security weaknesses can become far more dangerous because the IDE itself becomes a trusted component in the developer workflow.

For developers, the vulnerability underscores that trusted development tools deserve the same scrutiny as production software. As AI coding platforms become more deeply integrated into software engineering workflows, weaknesses in how they interact with local tools and repositories could become increasingly valuable targets for attackers.

Related News: ChatGPT has entered Check Point’s top 10 most impersonated brands in phishing attacks for the first time.

Joseph Ofonagoro

Joseph is a technical writer with about three years of experience creating clear, practical content across consumer technology, startups, tutorials, and cybersecurity. He is also advancing a career in cyber threat intelligence, driven by a strong interest in the responsible use of technology and its role in protecting people, organizations, and digital systems. His passion for cybersecurity grew out of a broader commitment to helping others understand technology safely and effectively. As an undergraduate at the National Open University of Nigeria, he leads a community of technology enthusiasts, guiding beginners, sharing learning resources, and helping students build confidence as they explore careers in tech. Joseph’s writing combines technical curiosity with an accessible, beginner-friendly style. In addition to his editorial work, he periodically shares cybersecurity case studies and research reports on social media, covering threat trends, security lessons, and practical insights for readers interested in cyber awareness and digital safety.