Executive brief
Cursor, a popular AI-powered code editor, is vulnerable to a security flaw that allows attackers to take control of a developer's computer. By tricking a user into opening a specially crafted project folder containing a malicious file disguised as a standard programming tool, the attacker can execute hidden code. This happens automatically when the project is opened and continues to run in the background without any further action or warning to the user.
Technical details
Cursor for Windows (v3.2.16 and earlier) is vulnerable to an Untrusted Search Path (CWE-426) flaw during its Git binary resolution process. When a workspace is opened, the IDE searches for the 'git.exe' binary and prioritizes the local repository root over system paths. An attacker can exploit this by distributing a malicious repository containing a 'git.exe' file; once the victim opens the folder in Cursor, the IDE automatically executes the binary under the current user's privileges. This execution occurs during startup and on a recurring timed cadence without user interaction or approval. As of the advisory date, the vendor has not released a patch, and researchers recommend opening untrusted repositories only in isolated environments.
Affected products
- Anysphere, Inc. (Cursor) Cursor 3.2.16 and earlier
Timeline
- 2025-12-15: disclosed: Initial discovery and report by Mindgard to Cursor security.
- 2026-07-17: advisory: Public disclosure by Mindgard and VulnCheck due to lack of vendor remediation.