Key Takeaways<\/p>\n
- \n
- No click needed.<\/strong> Opening a repo is enough if git.exe is in the root.<\/li>\n
- Months without fix.<\/strong> Report 15.12.2025, Full Disclosure 14. July 2026, 197+ versions later according to Mindgard still present.<\/li>\n
- Shadow-IT risk.<\/strong> AI IDEs should be included in software BOMs and whitelists.<\/li>\n
- Mitigation now.<\/strong> AppLocker\/App Control against Workspace executables; untrusted repos only in sandbox or VM.<\/li>\n<\/ul>\n<\/div>\n
Related:<\/span>TrapDoor Supply-Chain on npm\/PyPI<\/a> \/<\/span> Source Code Leaks and Patch Bypass<\/a><\/p>\n
The Bug in a Paragraph<\/h2>\n
What is the Cursor-git.exe Bug?<\/strong> When loading a project, Cursor searches for Git binaries in multiple locations, including the workspace. A git.exe placed in the repository root is executed as part of the path resolution. Process-monitor traces show Cursor.exe launching git rev-parse –show-toplevel with the workspace binary. Mindgard\u2019s PoC exploits Windows machines that rename calc.exe to git.exe. The calculator starts and respawns while running.<\/p>\n
\nDefinition \u00b7 Binary Planting in the IDE<\/p>\n
The Integrated Development Environment (IDE) also searches for tool binaries within the workspace. A compromised repository supplies git.exe in the root. When opened, the IDE launches the attacker\u2019s code in the developer\u2019s user context.<\/p>\n<\/div>\n
No prompt injection, no model jailbreak. Binary planting in the workspace. For attackers, a single compromised repository suffices: clone it, open it in Cursor, and the code runs in the developer\u2019s user context. Often granting access to tokens, SSH keys, and internal packages.<\/p>\n
Timeline and Vendor Silence<\/h2>\n
Mindgard reported on 15. December 2025 to security-reports@cursor.com. Via HackerOne and the CISO channel, confirmation and reproduction were obtained, after which, according to the research, there was long silence. On 14. July 2026, full disclosure followed because coordinated remediation did not occur. As of the research publication: no patch, no public advisory from the vendor.<\/p>\n
For CISOs, this is the second finding besides the bug: vendor SLA and disclosure hygiene belong in the evaluation of AI coding tools. Productivity alone is not a trust argument. Cursor is shadow IT in many engineering organizations. The fix horizon is unknown.<\/p>\n
What Companies Must Do Until the Fix<\/h2>\n
Until a vendor fix takes effect, the mitigation stays in place: inventory Cursor users on Windows, enforce policies for untrusted repositories, and deploy endpoint controls that block malicious workspace executables. This checklist represents the baseline security requirements for chief information security officers (CISOs) and engineering leads.<\/p>\n
\nSecure Cursor on Windows<\/p>\n
- \n
- ✓<\/span>Inventory: Which teams use Cursor on Windows (license, MDM, downloads)?<\/li>\n
- ✓<\/span>Policy: Do not open untrusted repositories in the production IDE; use only a VM or sandbox<\/li>\n
- ✓<\/span>App Control: Block execution of executables from developer workspace paths<\/li>\n
- ✓<\/span>EDR: Alert when Cursor.exe spawns unexpected child processes from repository paths<\/li>\n
- ✓<\/span>Software-BOM: Treat AI IDEs like any build tool, with owner, version, and exit criteria<\/li>\n<\/ul>\n<\/div>\n
AppLocker or Windows Defender Application Control (WDAC) should enforce path-based rules rather than hash-based ones; attackers can change hashes. Generally, do not allow any executables from workspace roots, not just git.exe. Binary planting is a known pattern across multiple AI IDEs. Those who demand \u201cno CVE in the scanner\u201d miss the risk. Primary source: Mindgard blog, 14.07.2026; cross\u2011checks also cited by Dark Reading and The Hacker News.<\/p>\n
Frequently Asked Questions<\/h2>\n
Every question is locked. A tap unlocks the answer.<\/p>\n
\nIs it relevant for macOS and Linux?<\/strong><\/summary>\n
The described exploit targets Windows and git.exe in the repository root. Other platforms are to be evaluated separately. Windows developers are the clear hotspot.<\/p>\n<\/details>\n
\nIs it enough to block git.exe?<\/strong><\/summary>\n
It is the current trigger. Path-Resolution can check additional tool names. Better: generally prohibit executables from workspace roots.<\/p>\n<\/details>\n
\nIs this the same as CVE-2026-26268 (Git Hooks)?<\/strong><\/summary>\n
No. 26268 concerns hidden Git hooks according to reports. The Mindgard case is Binary Planting of git.exe in the root. Different mechanism, same outcome: Code Execution.<\/p>\n<\/details>\n
\nWhat do we require from the vendor?<\/strong><\/summary>\n
Patch, Advisory, a clear Search-Path-Policy without Workspace-Exec, and transparent SLAs for Criticals in Bug-Bounty.<\/p>\n<\/details>\n
\nPrimary source?<\/strong><\/summary>\n
Mindgard Blog “Cursor 0day: When Full Disclosure Becomes the Only Protection Left” (14.07.2026).<\/p>\n<\/details>\n
<\/p>\n
Lesetipps der Redaktion<\/h3>\n
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/sharepoint-jwt-bypass-cve-2026-55040-cover-hero-250x143.jpg\")
<\/span>Lesetipp<\/span>SharePoint-JWT-Bypass \u00f6ffnet On-Prem-Sites<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/bitlocker-bypass-cve-2026-50661-cover-hero-250x143.jpg\")
<\/span>Lesetipp<\/span>BitLocker-Bypass bei physischem Zugriff<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/nihon-kotsu-ailock-dispatch-malware-case-cover-hero-250x143.jpg\")
<\/span>Lesetipp<\/span>Nihon Kotsu: Dispatch f\u00e4llt nach Malware<\/span><\/span><\/a><\/p>\nMehr aus dem MBF Media Netzwerk<\/h3>\n
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-aws-sovereign-cloud-was-wirklich-getrenn-12030184.jpg\")
<\/span>cloudmagazin<\/span>AWS Sovereign Cloud: was wirklich getrennt ist<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-digitaler-produktpass-hersteller-pflicht-48690623-250x141.jpg\")
<\/span>MyBusinessFuture<\/span>Digitaler Produktpass: Was Hersteller tun m\u00fcssen<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-token-opex-inference-steuert-nicht-das-s-43794747-250x141.jpg\")
<\/span>Digital Chiefs<\/span>Token-OPEX: Inference steuert, nicht das Seat-Budget<\/span><\/span><\/a><\/p>\nBildquelle: KI-generiert (Juli 2026)<\/p>\n
<\/p>\n","protected":false},"excerpt":{"rendered":"Mindgard: Cursor on Windows executes local repo git.exe without prompt. Reported Dec 2025, still unpatched as of July 2026. Policy and AppLocker mitigations available.","protected":false},"author":10,"featured_media":22154,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"cursor windows git execution vulnerability","_yoast_wpseo_title":"Cursor Launches git.exe from Repository Root on Windows","_yoast_wpseo_metadesc":"Mindgard: Cursor on Windows executes local repository git.exe without prompt. Reported in December 2025, remains unpatched as of July 2026.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"en","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":[],"footnotes":""},"categories":[259],"tags":[],"class_list":["post-22164","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-strategie-governance-en"],"evm_reading_time_minutes":4,"wpml_language":"en","wpml_translation_of":22139,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/22164","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=22164"}],"version-history":[{"count":0,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/22164\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/22154"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=22164"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=22164"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=22164"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- ✓<\/span>Policy: Do not open untrusted repositories in the production IDE; use only a VM or sandbox<\/li>\n
- Months without fix.<\/strong> Report 15.12.2025, Full Disclosure 14. July 2026, 197+ versions later according to Mindgard still present.<\/li>\n