Security researchers have uncovered an unpatched flaw in the AI‑assisted IDE Cursor that automatically runs a malicious git.exe placed in a repository’s root, enabling immediate code execution on Windows machines.

Key Takeaways

  • Cursor auto-executes malicious git.exe in repository root
  • Exploitation requires only opening a project, no complex chain
  • Seven months without a patch or response from the vendor

Cursor is one of the most popular AI‑assisted development environments, boasting over 7 million active users. Security firm Mindgard reports a critical, unpatched vulnerability on Windows that allows a malicious git.exe placed in a repository’s root to be executed automatically when the project is opened.

Technical Mechanics

When a developer opens a repository in Cursor, the IDE searches for Git binaries across several locations, including the workspace itself. If a tampered git.exe resides at the repository’s root, Cursor’s path‑resolution logic will launch it without warning, consent, or any indication that executable content is about to run. The attack does not rely on prompt injection, memory corruption, or any sophisticated tradecraft—simply opening the project is sufficient.

Disclosure Timeline and Vendor Response

Mindgard initially reported the flaw to Cursor on 15 December 2025. After seven months of silence, the company has yet to issue a patch or even acknowledge the issue. In January, Cursor’s CISO invited Mindgard to its HackerOne bug‑bounty program, where the vulnerability was resubmitted and confirmed reproducible, yet no formal response followed. During this period, developers may unknowingly execute hostile code, exposing systems to data theft, ransomware, or deeper compromise.

Potential Impact and Industry Implications

The vulnerability highlights a fundamental weakness in software supply‑chain security, especially as AI‑driven IDEs gain traction. Mitigations such as strict binary validation, sandboxing, and explicit user prompts are essential to prevent inadvertent execution of malicious binaries. Experts stress that coordinated disclosure must be paired with rapid remediation to safeguard the developer ecosystem.

Recommendations for Developers

Practitioners should audit newly cloned repositories for unexpected executables and consider isolating such files until verification. Cursor, on its part, needs to tighten its binary‑detection logic to only trust binaries from verified paths, thereby reducing the attack surface.