A critical unpatched security vulnerability in the popular AI-assisted development environment Cursor can be exploited for arbitrary code execution simply by opening a maliciously crafted repository, cybersecurity firm Mindgard has disclosed. The flaw, which affects the Windows version of Cursor, stems from how the application resolves and executes Git binaries when loading a project, and it has remained unaddressed by the vendor for over seven months following initial disclosure.
How the Cursor Vulnerability Enables Code Execution
Cursor, a fork of Visual Studio Code that integrates AI-powered features for code completion and generation, has grown rapidly to over 7 million active users. The vulnerability is alarmingly straightforward: when a developer opens a repository, Cursor automatically searches for Git binaries in multiple locations, including the root directory of the project itself. Mindgard found that if an attacker places a malicious git.execodecodecodecode binary in the repository root, Cursor will execute it automatically as part of its path resolution logic.
“The vulnerability is not theoretical,” Mindgard stated. “Exploitation simply requires a developer to open a project containing a git.exe binary in the repository at the root.” The execution occurs without any warning to the user, without asking for approval, and without any visible indication that executable content from the repository is about to run. This makes it a potent initial access vector for supply chain attacks targeting developers.
Supply Chain Risk for Developers Using Cursor
The primary concern is the potential for supply chain compromise. An attacker could host a seemingly benign open-source project on platforms like GitHub or GitLab that contains a malicious git.execodecodecodecode file. When a Cursor user clones and opens the repository, the application silently runs the attacker’s code, granting full access to the developer’s machine. This could lead to credential theft, source code exfiltration, deployment of backdoors, or lateral movement within a corporate network. Given that Cursor is used in development environments that often have access to production systems, CI/CD pipelines, and sensitive intellectual property, the impact of a successful attack is severe.
Timeline of Disclosure and Lack of Response
Mindgard reported the vulnerability to Cursor on December 15, 2025, but received no response regarding a potential patch for seven months. In January, Cursor’s CISO invited the researchers to their bug bounty program on HackerOne, where the issue was resubmitted and confirmed as reproducible by the platform. However, Mindgard reports that Cursor has not communicated further about remediation plans. “Coordinated disclosure only works when there is coordination,” Mindgard noted. “Withholding information no longer serves users; it serves silence.” The researchers have now published full technical details, making the vulnerability publicly exploitable and putting the onus on users to protect themselves.
What Developers Must Do to Mitigate This Threat
Until Cursor releases a patch, developers using the application on Windows should consider this a critical risk. The most effective immediate mitigation is to prevent Cursor from executing Git binaries from within a repository. This can be accomplished by using an endpoint protection solution that provides real-time threat detection and behavioral analysis, which can block the execution of unsigned or untrusted binaries originating from workspace directories. Additionally, developers should never open repositories from untrusted sources without first inspecting their contents. A safer workflow is to review the repository’s files in a browser or a restricted environment before opening it in Cursor. Enabling comprehensive file integrity monitoring and application control on development machines can also provide a critical layer of defense against this type of exploitation.
Affected Users Should Act Now
For developers and organizations using Cursor on Windows, the absence of a patch from the vendor means that proactive security measures are the only protection available. Immediately review your endpoint security configuration to ensure it can detect and block unexpected binary executions from your workspace folders. Consider using a multi-layer endpoint protection solution with behavioral analysis capabilities to scan for anomalous process launches. Avoid cloning and opening projects from unknown or unverified sources until an official fix is released. Monitor your development environments for any signs of compromise, and enforce strict access controls on repositories that contain sensitive code.
