Breaking

Unpatched Cursor Flaw Lets Malicious Repositories Silently Run Code on Windows, Researchers Warn

July 15, 2026 at 06:59 EDT

Security
Software Dev & Coding

Security researchers at Mindgard have disclosed an unpatched vulnerability in the Windows version of the AI-powered code editor Cursor that allows a cloned repository to silently execute an attacker-supplied binary the moment a developer opens it—no prompt, approval, or agent interaction required.

July 14, 2026 · Security Disclosure

Open a Repo, Run the Malware: Cursor's Unpatched Windows Flaw

A cloned repository can silently execute an attacker's binary the instant a developer opens it in Cursor for Windows — no prompt, no approval, no agent interaction. Reported in December 2025, it remains unpatched.

clicks needed — code runs on open

months reported, still no fix

197+

version releases without resolution

7M+

active users in exposure range

How the attack works

A rogue git.exe hijacks the workspace

Poisoned repo

Attacker drops git.exe in repo root

→

Developer opens it

Cursor prioritizes the root path over the real Git

→

Auto Git call

git rev-parse --show-toplevel fires

→

Binary executes

Runs as the user — repeatedly while open

Disclosure timeline

Dec 15, 2025

Reported to vendor

Apr 30, 2026

Still present in v3.2.16

Jul 14, 2026

Full disclosure — no fix

Why it's dangerous

No prior access or user action beyond opening
Re-executes every time the workspace is open
Could be paired with credential stealers
Scoped to the Windows build of Cursor

Recommended mitigations

Use AppLocker / Windows App Control
Deny git.exe execution from workspace paths
Favor path-based rules over hash-based
Open untrusted repos in a VM or sandbox

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.