# Unpatched Cursor IDE 0-Day: Malicious git.exe in Repository Root Enables Arbitrary Code Execution on Windows (CWE-427)

> Security firm Mindgard publicly disclosed a Windows-only 0-day in the Cursor AI code editor: when a project is opened, Cursor's Git-binary path resolution logic searches the repository's own root directory for git.exe and executes whatever it finds there, with no user prompt, warning, or approval dialog. An attacker who plants a malicious git.exe at the root of a repo achieves automatic, repeated code execution the moment a victim opens that folder in Cursor. Reported to Cursor on December 15, 2025, the flaw survived more than 70 subsequent releases and 33 published security advisories with no fix or acknowledgment, until Mindgard published full technical details on July 14-15, 2026; Cursor reportedly patched the issue on July 13, 2026, one day ahead of disclosure.

- **Published:** 2026-07-15T00:00:00Z
- **Last reviewed:** 2026-07-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1377
- **ID:** TL-2026-1377
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Cursor is a widely deployed AI-native fork of VS Code used by professional developers and enterprises for AI-assisted coding. Researcher Aaron Portnoy at Mindgard discovered that on Windows, when Cursor loads a project it resolves the location of the Git binary by checking several candidate paths, one of which is the workspace/repository root itself, ahead of (or interchangeably with) the system PATH. This mirrors the classic Windows 'binary planting' / DLL-and-EXE search-order hijacking pattern tracked generically as CWE-427 (Uncontrolled Search Path Element) and CWE-426 (Untrusted Search Path).

Because repository content is fully attacker-controlled when a victim clones or opens a third-party repo, an attacker can commit an executable named git.exe into the repository root. The moment the victim opens that folder in Cursor -- with no click, no approval dialog, and no indication that executable content is about to run -- Cursor invokes the planted binary using a standard git.exe rev-parse --show-toplevel style command line, and continues to re-invoke it repeatedly as the IDE performs routine Git status/refresh operations while the project remains open.

Mindgard's proof of concept used an intentionally harmless payload: Windows Calculator (calc.exe) renamed to git.exe and committed to the repository root. Opening the project in Cursor caused Process Monitor to record Cursor.exe repeatedly spawning the planted binary, producing multiple Calculator windows over time purely from opening a directory -- demonstrating reliable, repeated, zero-click code execution at the victim's privilege level with no attacker interaction required after the initial repo commit.

Mindgard reported the bug to security-reports@cursor.com on December 15, 2025. The report was met with automation failures, a HackerOne submission initially closed as 'Informative and out of scope,' a brief CISO re-engagement after public LinkedIn outreach, and then months of unanswered follow-ups from February through April 2026. Mindgard re-verified the bug as still present in Cursor 3.2.16 on April 30, 2026, and again confirmed it unpatched against Cursor 3.11 (released July 10, 2026) -- more than 70 releases after the original report. The Hacker News reviewed all 33 security advisories Cursor had published as of the disclosure date and found none covering this issue. Mindgard announced intent to publish on June 1, 2026 and released full technical details on July 14-15, 2026; a Cursor spokesperson subsequently stated the git.exe issue was addressed on July 13, 2026, the day before disclosure.

The bug sits alongside a broader pattern of AI-IDE trust-boundary failures disclosed in the same window: Cursor's separately-tracked 'DuneSlide' sandbox-escape vulnerabilities (CVE-2026-50548 and CVE-2026-50549, CVSS 9.8), fixed in Cursor 3.0 on April 2, 2026, allowed zero-click prompt-injection-driven remote code execution outside the IDE's sandbox by abusing automatic terminal command execution. Researchers also identified the same workspace-root Git-binary search-order weakness in other AI coding tools, including GitHub Copilot CLI and Google Gemini CLI, and a functionally identical class of vulnerability was previously fixed in Git Credential Manager Core as CVE-2020-26233 six years earlier -- indicating this is a recurring, insufficiently-learned lesson across the developer-tooling ecosystem rather than a one-off implementation bug.

No CVE identifier has been publicly assigned to the Cursor git.exe issue as of this writing. Because exploitation requires no vulnerability in Cursor's memory safety or sandboxing -- only a victim opening an attacker-supplied folder -- the primary attack surface is the supply chain of third-party/open-source repositories, coding challenges, take-home interview assignments, forked tutorial repos, and any workflow where developers routinely clone and open unfamiliar codebases in Cursor.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1189 Drive-by Compromise
- T1204 User Execution
- T1106 Native API
- T1059 Command and Scripting Interpreter
- T1574 Hijack Execution Flow
- T1574 Hijack Execution Flow
- T1036 Masquerading
- T1218 System Binary Proxy Execution
- T1082 System Information Discovery
- T1005 Data from Local System
- T1587 Develop Capabilities
- T1584 Compromise Infrastructure

## Sources

- [Cursor 0day: When Full Disclosure Becomes the Only Protection Left](https://mindgard.ai/blog/cursor-0day-when-full-disclosure-becomes-the-only-protection-left)
- [Critical Cursor 0-Day Flaw Allows Arbitrary Code Execution via Malicious git.exe](https://cybersecuritynews.com/critical-cursor-0-day-flaw/)
- [Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution](https://thehackernews.com/2026/07/cursor-flaw-lets-malicious-cloned.html)
- [Cursor IDE Auto-Executes Malicious Code in Poisoned Repos](https://www.darkreading.com/application-security/cursor-ide-malicious-code-poisoned-repos)
- [Cursor IDE 0-day vulnerability allows automatic code execution from malicious repositories](https://www.kucoin.com/news/flash/cursor-ide-0day-vulnerability-allows-automatic-code-execution-from-malicious-repositories)
- [Cursor 0day: Why a 7-Month-Old Vulnerability Is Still Unpatched](https://www.developersdigest.tech/blog/cursor-0day-git-exe-vulnerability)
- [A vulnerability in Cursor that allows arbitrary code execution simply by 'opening the repository' has not been fixed even 7 months after it was reported](https://gigazine.net/gsc_news/en/20260715-cursor-0day-disclosure/)
- [Cursor IDE Executes Malicious git.exe From Poisoned Repositories](https://www.mallory.ai/stories/019f60be-331e-74a7-b2d0-5e9cac5915eb)
- [Cursor vulnerability allows execution of malicious binaries](https://www.scworld.com/brief/cursor-vulnerability-allows-execution-of-malicious-binaries)
- [Cursor Has a 7-Month-Old Security Hole That Executes Malicious Code on Launch](https://www.nocode.tech/article/cursor-has-a-7-month-old-security-hole-that-executes-malicious-code-on-launch-and-nobodys-talking-about-it)
- [Critical Cursor AI Code Editor Flaws Could Lead to OS-Level Remote Code Execution (DuneSlide, CVE-2026-50548 / CVE-2026-50549)](https://www.securityweek.com/critical-cursor-ai-ide-flaws-could-lead-to-os-level-remote-code-execution/)
- [Sandbox bypass flaws in Cursor IDE highlight prompt injection as an RCE vector](https://www.csoonline.com/article/4191923/sandbox-bypass-flaws-in-cursor-ide-highlight-prompt-injection-as-an-rce-vector.html)
- [CVE-2026-22708: Cursor AI Code Editor RCE Vulnerability](https://www.sentinelone.com/vulnerability-database/cve-2026-22708/)
- [CWE-427: Uncontrolled Search Path Element](https://cwe.mitre.org/data/definitions/427.html)
- [CWE-426: Untrusted Search Path](https://cwe.mitre.org/data/definitions/426.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1377