Mindgard researcher Aaron Portnoy published a full public disclosure (July 15, 2026; coverage July 16) of a Windows code-execution vulnerability in the Cursor AI code editor after reporting it to Cursor on December 15, 2025 and receiving no patch or security advisory across seven months.
Vulnerability mechanism:
- On Windows, when Cursor loads a project folder it searches for a Git binary in multiple filesystem locations — including the workspace root.
- Cursor then runs
git rev-parse --show-toplevelagainst whatever binary it finds. - If a file named
git.exesits in the project root, Cursor executes it immediately with no prompt, warning, or additional user action beyond opening the folder. - Attack: publish a malicious repo with trojanized
git.exealongside legitimate-looking source; when a developer clones and opens it in Cursor on Windows, the trojan runs with the developer’s process permissions.
Confirmed versions: Flaw present in Cursor 3.2.16 (tested April 30, 2026) and still present in Cursor 3.11 (shipped July 10, 2026). As of disclosure date, Cursor had published no security advisory.
Impact: Developer workstations often hold cloud credentials (~/.aws/), SSH keys (~/.ssh/), API tokens, CI/CD and production access — enabling silent exfiltration before the developer reviews the code.
Distinction: Separate from earlier DuneSlide prompt-injection issue in Cursor’s AI sandbox; this is OS-level binary path search during workspace load, unrelated to AI components.
Disclosure norms: Industry typically uses ~90-day coordinated disclosure with extensions for active remediation; seven months without patch or advisory exceeds that window. Mindgard disclosed publicly to prompt acknowledgment and a fix.
Mitigation until patch: Windows developers should avoid opening untrusted/unfamiliar repositories in Cursor; Cursor should stop searching workspace root for git.exe or warn when a project-root executable named git.exe is present.