Cursor bug runs malicious git.exe when repo is opened

Security researchers at Mindgard reported an unpatched vulnerability in Cursor for Windows that can automatically run a malicious git.exe placed at a repository’s root when a developer opens the project. The execution happens without a warning or approval prompt.

Mindgard found that Cursor’s path-resolution logic searches for Git binaries in multiple locations, including inside the workspace. As part of choosing which Git to use, the application will execute a git.exe found at the repository root, the researchers said, and it provides no visible indication that an executable from the workspace will be launched.

The researchers described the flaw as low-complexity and practical. “The vulnerability is not theoretical and does not depend on a complex chain of exploitation, prompt injection, model manipulation, jailbreaks, memory corruption, or sophisticated attacker tradecraft. Exploitation simply requires a developer to open a project containing a git.exe binary in the repository at the root,” Mindgard wrote in its public post.

Mindgard reported the issue to Cursor on December 15, 2025. The firm was invited to Cursor’s bug bounty program on HackerOne in January and resubmitted the finding, where the defect was confirmed as reproducible. After seven months with no patch or public remediation details, Mindgard disclosed the vulnerability publicly, saying coordinated disclosure had broken down: “But coordinated disclosure only works when there is coordination. Seven months after initial disclosure, we have no indication that users are being protected, that remediation is underway, or that affected organizations have been informed. And at this point, withholding information no longer serves users; it serves silence.”

According to Mindgard, an attacker who can add files to a repository-such as through a cloned or forked project, a compromised package, or a malicious contribution-could place a crafted git.exe in the root and cause code to run on a developer’s machine when the project is opened. The issue applies specifically to Cursor on Windows.

Cursor is an AI-assisted development environment used by more than seven million active users. As of Mindgard’s public disclosure, Cursor had not announced a patch or published remediation details. Mindgard provided a timeline and technical description to help organizations and developers assess exposure while a formal fix is not available.