Untrusted Search Path

Definition

A class of vulnerabilities where software resolves helper binaries (or libraries) from attacker-influenced locations — such as the current workspace — before trusted system paths, enabling silent arbitrary code execution. Catalogued as CWE-426/427.

Key Points

• Classic on Windows when apps prefer cwd/workspace over PATH
• In AI IDEs, automatic Git status probes can trigger execution on folder open
• cursor-git-exe-rce (Mindgard, Jul 2026): git.exe in repo root executed via git rev-parse --show-toplevel
• Mitigations: never resolve executables from untrusted workspaces; Workspace Trust; AppLocker path denies; sandbox untrusted clones

Related

• cursor
• cursor-git-exe-rce
• supply-chain-security
• ai-agent-security
• sandboxing
• cybersecurity

Sources

• 2026-07-17-cursor-git-exe-mindgard-primary
• 2026-07-17-cursor-git-exe-darkreading