Critical Cursor 0-day Vulnerability Allows Arbitrary Code Execution

Key Takeaways

• A critical 0-day vulnerability (CVE-2026-63093) in the Cursor IDE allows arbitrary code execution on Windows systems.
• The flaw stems from a binary planting issue where a malicious git.exe or other executables placed in a repository’s root can automatically execute when a developer opens the project.
• Rated CVSS 8.7, the vulnerability requires no user interaction beyond opening the project, especially since Cursor’s Workspace Trust feature is often disabled by default.
• While Cursor reportedly addressed the specific git.exe issue on July 13, 2026, the underlying binary resolution logic remains a concern, with other executables like hatch.exe also susceptible.

Critical Flaw in Cursor IDE Enables Arbitrary Code Execution via Binary Planting

A severe binary planting vulnerability identified in the Cursor integrated development environment (IDE) on Windows poses a significant risk, allowing attackers to achieve arbitrary code execution. The flaw, tracked as CVE-2026-63093 with a CVSS score of 8.7, enables a malicious executable, such as a specially crafted git.exe file, to automatically run the moment a developer opens a compromised project.

Unpacking the Vulnerability: How it Works

The vulnerability’s core lies in Cursor’s process for locating binaries. When a developer loads a project, the IDE attempts to find a Git binary to execute introspection commands like git rev-parse –show-toplevel. On Windows, the operating system’s executable search order prioritizes the current working directory before checking trusted system paths. This behavior creates a critical security gap.

Mindgard, the security firm that discovered the flaw, reported it to Cursor on December 15, 2025. Their research demonstrated that if an attacker places a malicious file named git.exe in the root of a repository and no legitimate Git executable exists there, Windows will resolve and execute the attacker’s file instead. This execution occurs under the privileges of the logged-in user, requiring no agent, AI model, or prior access to the victim’s machine.

Proof of Concept and Vendor Response

Mindgard validated the vulnerability by renaming the Windows Calculator application to git.exe and embedding it within a test repository. Simply opening this folder in Cursor caused the calculator application to launch, proving the exploit’s efficacy.

Initially, Cursor deemed the report outside the scope of its bug bounty program, asserting that customers bore responsibility for the repositories and external content they chose to open. However, the company later informed reporters that it addressed the issue on July 13, 2026, just prior to Mindgard’s public disclosure on July 14, 2026. Despite the fix, no formal security advisory acknowledging the severity of the bug was released.

Beyond git.exe: A Broader Attack Surface

Further independent research conducted in early 2026 revealed that the auto-execution behavior is not confined solely to git.exe. Cursor also attempts to resolve and execute hatch.exe when a pyproject.toml file is present in an opened repository. This follows the same CreateProcess-based resolution logic, with the pyproject.toml file merely acting as a trigger.

This variant presents a stealthier attack vector, as a pyproject.toml file with a standard-looking build-system entry is unlikely to raise immediate red flags for defenders, unlike more commonly monitored execution mechanisms such as tasks.json.

Workspace Trust Limitations and Default Settings

IDE features like “Workspace Trust” are designed to act as a security barrier, blocking execution in untrusted folders. However, testing on Trae IDE, which enables Workspace Trust by default, showed that it still repeatedly attempts to locate git.exe within an untrusted workspace. While Workspace Trust can restrict certain actions, the underlying binary resolution behavior still creates an execution path if a malicious binary is placed where the IDE searches for it.

According to Maland reports, Cursor ships with Workspace Trust disabled by default. This means that merely opening a folder could trigger code execution without any additional clicks, prompts, or confirmation dialogues, significantly lowering the bar for attackers.

Security teams that focus solely on filtering for “git.exe” as a threat indicator risk leaving a blind spot, as other attacker-controlled binaries can trigger identical zero-click execution under different circumstances. The true security boundary is not the executable’s name but the transition from untrusted project content to executable code the moment a folder is opened.

Accumulating Attack Surface in AI-Powered IDEs

This git.exe vulnerability is one of several Cursor flaws disclosed in 2026. Earlier in the year, CVE-2026-50548 and CVE-2026-50549, collectively dubbed “DuneSlide,” were patched in Cursor 3.0. These vulnerabilities permitted sandbox escape and OS-level remote code execution through prompt injection.

Furthermore, researchers have identified that Cursor and Windsurf remain vulnerable to dozens of unpatched Chromium-based vulnerabilities inherited from outdated Electron builds, potentially affecting an estimated 1.8 million developers. These cumulative disclosures highlight that AI-powered IDEs are rapidly accumulating a broad attack surface, encompassing binary resolution, sandbox trust boundaries, and outdated embedded components.

What You Should Do

• Enable Workspace Trust: If your IDE supports Workspace Trust, ensure it is enabled and configured to restrict execution in untrusted folders.
• Exercise Caution with Repositories: Treat every executable file within a project workspace as potentially malicious. Avoid opening repositories from unfamiliar or unverified sources.
• Update Your IDE: Keep your Cursor IDE and any other development tools updated to the latest versions to receive critical security patches.
• Monitor for Malicious Binaries: Implement endpoint detection and response (EDR) solutions to monitor for unusual process execution, especially for binaries launched from project directories.
• Educate Developers: Inform development teams about binary planting risks and the importance of scrutinizing repository contents before opening projects.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.