Unpatched Cursor IDE 0-Day: Malicious git.exe in Repository Root Enables Arbitrary Code Execution on Windows (CWE-427)
Unpatched Cursor IDE 0-Day (TL-2026-1377), also tracked as Cursor git.exe 0-day, is a high-severity software vulnerability, first published 2026-07-15. It has no confirmed attribution, affects Cursor (Anysphere) Cursor AI Code Editor (Windows), maps to 12 MITRE ATT&CK techniques (T1005, T1036, T1059), and is covered by 9 detection rules and 19 indicators of compromise.
Key facts for TL-2026-1377
- Threat ID
- TL-2026-1377
- Also known as
- Cursor git.exe 0-day, Cursor Workspace-Root Git Binary Planting
- Severity
- HIGH
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-07-15
- Last reviewed
- 2026-07-15
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, finance, government administration, health, education
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 19
Malware and tooling in Unpatched Cursor IDE 0-Day
Malware and tooling: GitHub Copilot CLI, Google Gemini CLI, Sysinternals Process Monitor (ProcMon)
Security firm Mindgard publicly disclosed a Windows-only 0-day in the Cursor AI code editor: when a project is opened, Cursor's Git-binary path resolution logic searches the repository's own root directory for git.exe and executes whatever it finds there, with no user prompt, warning, or approval dialog. An attacker who plants a malicious git.exe at the root of a repo achieves automatic, repeated code execution the moment a victim opens that folder in Cursor. Reported to Cursor on December 15, 2025, the flaw survived more than 70 subsequent releases and 33 published security advisories with no fix or acknowledgment, until Mindgard published full technical details on July 14-15, 2026; Cursor reportedly patched the issue on July 13, 2026, one day ahead of disclosure.
How Unpatched Cursor IDE 0-Day works
Cursor is a widely deployed AI-native fork of VS Code used by professional developers and enterprises for AI-assisted coding. Researcher Aaron Portnoy at Mindgard discovered that on Windows, when Cursor loads a project it resolves the location of the Git binary by checking several candidate paths, one of which is the workspace/repository root itself, ahead of (or interchangeably with) the system PATH. This mirrors the classic Windows 'binary planting' / DLL-and-EXE search-order hijacking pattern tracked generically as CWE-427 (Uncontrolled Search Path Element) and CWE-426 (Untrusted Search Path).
Because repository content is fully attacker-controlled when a victim clones or opens a third-party repo, an attacker can commit an executable named git.exe into the repository root. The moment the victim opens that folder in Cursor -- with no click, no approval dialog, and no indication that executable content is about to run -- Cursor invokes the planted binary using a standard git.exe rev-parse --show-toplevel style command line, and continues to re-invoke it repeatedly as the IDE performs routine Git status/refresh operations while the project remains open.
Mindgard's proof of concept used an intentionally harmless payload: Windows Calculator (calc.exe) renamed to git.exe and committed to the repository root. Opening the project in Cursor caused Process Monitor to record Cursor.exe repeatedly spawning the planted binary, producing multiple Calculator windows over time purely from opening a directory -- demonstrating reliable, repeated, zero-click code execution at the victim's privilege level with no attacker interaction required after the initial repo commit.
Mindgard reported the bug to security-reports@cursor.com on December 15, 2025. The report was met with automation failures, a HackerOne submission initially closed as 'Informative and out of scope,' a brief CISO re-engagement after public LinkedIn outreach, and then months of unanswered follow-ups from February through April 2026. Mindgard re-verified the bug as still present in Cursor 3.2.16 on April 30, 2026, and again confirmed it unpatched against Cursor 3.11 (released July 10, 2026) -- more than 70 releases after the original report. The Hacker News reviewed all 33 security advisories Cursor had published as of the disclosure date and found none covering this issue. Mindgard announced intent to publish on June 1, 2026 and released full technical details on July 14-15, 2026; a Cursor spokesperson subsequently stated the git.exe issue was addressed on July 13, 2026, the day before disclosure.
The bug sits alongside a broader pattern of AI-IDE trust-boundary failures disclosed in the same window: Cursor's separately-tracked 'DuneSlide' sandbox-escape vulnerabilities (CVE-2026-50548 and CVE-2026-50549, CVSS 9.8), fixed in Cursor 3.0 on April 2, 2026, allowed zero-click prompt-injection-driven remote code execution outside the IDE's sandbox by abusing automatic terminal command execution. Researchers also identified the same workspace-root Git-binary search-order weakness in other AI coding tools, including GitHub Copilot CLI and Google Gemini CLI, and a functionally identical class of vulnerability was previously fixed in Git Credential Manager Core as CVE-2020-26233 six years earlier -- indicating this is a recurring, insufficiently-learned lesson across the developer-tooling ecosystem rather than a one-off implementation bug.
No CVE identifier has been publicly assigned to the Cursor git.exe issue as of this writing. Because exploitation requires no vulnerability in Cursor's memory safety or sandboxing -- only a victim opening an attacker-supplied folder -- the primary attack surface is the supply chain of third-party/open-source repositories, coding challenges, take-home interview assignments, forked tutorial repos, and any workflow where developers routinely clone and open unfamiliar codebases in Cursor.
MITRE ATT&CK techniques used in TL-2026-1377
Collection
Defense Evasion
T1036 Masquerading; T1218 System Binary Proxy Execution; T1574 Hijack Execution Flow
Execution
T1059 Command and Scripting Interpreter; T1106 Native API; T1204 User Execution
Discovery
T1082 System Information Discovery
Initial Access
T1189 Drive-by Compromise; T1195 Supply Chain Compromise
stealth
Resource Development
Affected products and versions in Unpatched Cursor IDE 0-Day
- Cursor (Anysphere) — Cursor AI Code Editor (Windows)
Vulnerable versions: <= 3.2.16 (confirmed vulnerable, tested April 30, 2026); <= 3.11 (confirmed vulnerable, released July 10, 2026); 70+ releases between Dec 15, 2025 report and July 14, 2026 disclosure
Fixed in: First release after July 13, 2026 (per vendor spokesperson statement; no formal advisory/version number published)
Remediation for Unpatched Cursor IDE 0-Day
Patches
- Cursor spokesperson reported the git.exe workspace-root execution issue was addressed on July 13, 2026; users should update to the first Cursor release after that date and confirm the fix via vendor release notes (no formal CVE/advisory number published by Cursor as of disclosure)
Immediate actions
- Deploy AppLocker or Windows Defender App Control path-based deny rules blocking execution of git.exe (and other commonly-searched binaries) from developer workspace directories, e.g. %USERPROFILE%\source\repos\*\git.exe
- Prefer path-based deny rules over hash-based rules since attackers can trivially vary the planted binary
- Open any untrusted, third-party, or newly-cloned repository only inside a disposable Windows Sandbox or isolated VM before opening it in Cursor
- Manually inspect cloned repositories for suspicious root-level executables (git.exe, npx.exe, node.exe, where.exe, cmd.exe) before opening them in an AI IDE
- Monitor Task Manager / EDR for unexpected child processes of Cursor.exe, especially unsigned or non-standard git.exe binaries
Workarounds
- Disable or restrict Cursor's automatic Git integration/auto-detection where the IDE setting allows specifying an explicit, fully-qualified path to a trusted git.exe instead of relying on automatic workspace search
- Use a separate, non-AI editor or terminal to first inspect any newly cloned repository's file listing before opening it in Cursor
Longer-term hardening
- Deploy EDR rules that alert on Cursor.exe spawning any Git binary whose file hash or signature does not match the system-installed Git for Windows package
- Enforce organization-wide policy that developers clone third-party/take-home/tutorial repositories only into sandboxed or ephemeral environments
- Track vendor security advisories for Cursor and other AI-native IDEs (GitHub Copilot CLI, Google Gemini CLI, OpenAI Codex) for fixes to the same workspace-root binary search-order class of bug
- Pressure/track AI coding-tool vendors to resolve workspace-root binary search order so the current directory is never searched ahead of a verified system PATH
Weaknesses (CWE) in Unpatched Cursor IDE 0-Day
CWE-427, CWE-426, CWE-88
Timeline of Unpatched Cursor IDE 0-Day
- Mindgard researcher Aaron Portnoy reports the workspace-root git.exe auto-execution vulnerability to security-reports@cursor.com.
- Mindgard sends first follow-up requesting receipt confirmation after no initial response.
- Mindgard posts publicly on LinkedIn seeking a Cursor security contact after continued silence.
- Cursor's CISO responds and manually issues a HackerOne bounty program invitation.
- HackerOne report is initially closed as 'Informative and out of scope,' then reopened following pushback.
- HackerOne confirms formal delivery of the report to Cursor after an earlier automation failure.
- Cursor engagement ceases; Mindgard's subsequent status requests (Feb-Apr 2026) go unanswered.
- Cursor patches the separately-tracked DuneSlide sandbox-escape vulnerabilities (CVE-2026-50548, CVE-2026-50549, CVSS 9.8) in Cursor 3.0, unrelated to the still-open git.exe report.
- Mindgard re-verifies the git.exe issue is still present and exploitable in Cursor 3.2.16.
- Mindgard publicly announces intent to release full technical details given the vendor's continued silence.
- Cursor 3.11 is released and confirmed still vulnerable to the workspace-root git.exe execution flaw.
- A Cursor spokesperson states the git.exe issue was addressed, one day ahead of Mindgard's public disclosure.
- Mindgard publishes 'Cursor 0day: When Full Disclosure Becomes the Only Protection Left,' with full PoC and disclosure-timeline details.
- Widespread security media coverage (The Hacker News, Cyber Security News, Dark Reading, SC Media, GIGAZINE, and others) amplifies the disclosure.
Sources cited for Unpatched Cursor IDE 0-Day
- Cursor 0day: When Full Disclosure Becomes the Only Protection Left
- Critical Cursor 0-Day Flaw Allows Arbitrary Code Execution via Malicious git.exe
- Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution
- Cursor IDE Auto-Executes Malicious Code in Poisoned Repos
- Cursor IDE 0-day vulnerability allows automatic code execution from malicious repositories
- Cursor 0day: Why a 7-Month-Old Vulnerability Is Still Unpatched
- A vulnerability in Cursor that allows arbitrary code execution simply by 'opening the repository' has not been fixed even 7 months after it was reported
- Cursor IDE Executes Malicious git.exe From Poisoned Repositories
- Cursor vulnerability allows execution of malicious binaries
- Cursor Has a 7-Month-Old Security Hole That Executes Malicious Code on Launch
- Critical Cursor AI Code Editor Flaws Could Lead to OS-Level Remote Code Execution (DuneSlide, CVE-2026-50548 / CVE-2026-50549)
- Sandbox bypass flaws in Cursor IDE highlight prompt injection as an RCE vector
- CVE-2026-22708: Cursor AI Code Editor RCE Vulnerability
- CWE-427: Uncontrolled Search Path Element
- CWE-426: Untrusted Search Path
Threats related to Unpatched Cursor IDE 0-Day
Detection coverage for TL-2026-1377
As of 2026-07-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1377 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.