Cursor left a bug unfixed for 7 months
Mindgard disclosed a Cursor flaw that auto-runs a malicious git.exe planted in a repo's root, unpatched since December despite 70-plus releases.
Security firm Mindgard has publicly disclosed a critical, still-unpatched vulnerability in Cursor’s Windows editor: opening a repository whose root directory contains a file named git.exe causes Cursor to execute that binary automatically, with no click, no warning, and no user interaction required. The editor searches multiple locations for a Git executable, including the workspace itself, and will run whatever it finds there under the user’s own privileges. Mindgard’s proof of concept renamed Windows Calculator to git.exe and showed it launching repeatedly during ordinary use of the editor.
The exploit requires nothing more than a developer opening a compromised repository, something that happens routinely when cloning a client’s codebase, checking out a contributor’s fork, or working through a coding assignment. Mindgard reported the issue to Cursor’s security team on December 15, 2025. After no substantive response, it escalated through HackerOne on January 15, 2026, where the report was initially closed as out of scope before being reopened on challenge. From February through June, repeated requests for a status update went unanswered. Cursor’s engagement, per Mindgard, amounted to an early acknowledgment and a manual invite to its bug bounty program, nothing more, across more than 70 version releases in that window. Mindgard went public on July 14, 2026, arguing disclosure was the only remaining way to protect users.
Cursor’s own numbers underline the exposure: more than 7 million active users, over 1 million paying subscribers, and 50,000-plus companies using it, per Mindgard’s writeup.
Until Cursor confirms a fix, the safe posture is to treat any repository you did not create yourself as untrusted input to the editor, not just to whatever agent is running inside it, and to avoid opening unfamiliar repos in Cursor on Windows specifically, where this flaw lives. See keep your coding agent from running attacker code for the wider pattern of untrusted repos compromising AI-assisted development tools.