Security firm Mindgard has publicly disclosed a vulnerability in the AI-powered code editor Cursor that allows a malicious repository to execute arbitrary code on Windows machines the moment a developer opens it, with no prompt, warning, or approval—more than seven months after the flaw was first reported and still without a patch.
Mid-July 2026 · Cursor Zero-Day Disclosure
Opening a Repo Is Enough: Unpatched Cursor Flaw Runs Code With Zero Clicks
On Windows, a malicious file named git.exe placed in a repository's root runs automatically the moment a developer opens the project — no prompt, no warning, no approval. Disclosed publicly after seven months without a fix.
0
clicks needed — code runs on opening the folder
7 mo
since first reported, still unpatched
70+
version updates shipped without a fix
7M+
active Cursor users potentially exposed
How the attack fires
Cursor's path-resolution searches multiple locations — including the workspace root — for a Git binary.
1 · Poisoned repo
Attacker drops a malicious git.exe in the repo root
→
2 · Developer opens it
Clones and opens the folder in Cursor on Windows
→
3 · Auto-execution
Cursor finds and runs it under the user's privileges — repeatedly
Proof of concept: researchers renamed Windows Calculator to git.exe — it launched simply by opening the folder. Affects Windows only; macOS and Linux are unaffected.
Cursor's position
Calls it out of scope for the bug bounty program
Frames it as a shared-responsibility model — users choose what they open
Recommends relying on VS Code's Workspace Trust
Admits it failed to respond in time; no commitment to a fix
Security community
Flag it as effectively zero-click remote code execution
Open untrusted repos in a sandbox or VM
Use AppLocker to block execution from workspace folders
Scan cloned projects before opening; keep Workspace Trust on
Until Cursor addresses the binary-resolution behavior or publishes an official advisory, the burden of protection falls on users — avoid untrusted repositories and isolate unknown code before opening it.
Continue reading The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.
Already purchased? Sign in ✓ Signed in — this article isn’t included in your current plan.Unlocking the full article…