Cursor Flaw Enables Code Execution via Malicious Cloned Repositories on Windows

A critical vulnerability in Cursor, an AI-powered code editor, allows arbitrary code execution on Windows when a user opens a cloned repository containing a malicious git.exe file. The flaw, reported by AI security firm Mindgard on December 15, 2025, remains unpatched as of July 2026. Cursor automatically executes the workspace binary without user interaction, enabling attackers to steal SSH keys, cloud tokens, and source code.

Mindgard published full technical details on July 14, 2026, after Cursor failed to respond to repeated update requests. The vulnerability affects Cursor versions up to at least 3.2.16, with no CVE assigned. Similar issues were found in GitHub Copilot CLI, Gemini CLI, and Codex desktop app by Cymulate, with only AWS patching its Kiro tool (CVE-2026-10591).

Workarounds include using AppLocker or Windows App Control to block executables by path, or opening untrusted repositories in a disposable VM or Windows Sandbox. The flaw exploits Windows’ untrusted search path, a class of vulnerability previously seen in Git Credential Manager Core (CVE-2020-26233).