--- title: Cursor IDE Auto-Executes Malicious Code in Poisoned Repos description: A security vulnerability in the Cursor AI IDE allows automatic execution of malicious binaries when a developer opens a repository containing a poisoned... canonical: https://daily.dev/posts/cursor-ide-auto-executes-malicious-code-in-poisoned-repos-awzav5xbm twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Cursor IDE Auto-Executes Malicious Code in Poisoned Repos | daily.dev og:description: A security vulnerability in the Cursor AI IDE allows automatic execution of malicious binaries when a developer opens a repository containing a poisoned... og:url: https://daily.dev/posts/cursor-ide-auto-executes-malicious-code-in-poisoned-repos-awzav5xbm og:image: https://api.daily.dev/og/posts/aWzaV5xbM.png og:image:alt: Cursor IDE Auto-Executes Malicious Code in Poisoned Repos og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Cursor IDE Auto-Executes Malicious Code in Poisoned Repos **[Dark Reading](https://daily.dev/sources/dr)** · 4 min read · 0 upvotes · 0 comments ## Summary A security vulnerability in the Cursor AI IDE allows automatic execution of malicious binaries when a developer opens a repository containing a poisoned git.exe file at its root. Offensive security firm Mindgard discovered and reported the flaw to Cursor in December 2024, but after seven months and multiple disclosure attempts via email, LinkedIn, and HackerOne, Cursor has not patched it. The attack requires no user interaction beyond opening the repository, and the malicious binary runs with the developer's full privileges. Mindgard has now gone public with full details after exhausting coordinated disclosure options. Mitigations include using AppLocker/Windows App Control policies on enterprise systems and opening untrusted repos only in isolated VMs or sandboxes until a patch is released. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does the Cursor git.exe auto-execution vulnerability work? Cursor searches multiple locations for Git binaries when loading a project, including the workspace root itself. If an attacker places a malicious file named git.exe at the repository root, Cursor automatically executes it during path resolution with no warning, approval prompt, or indication that repository code is running. Mindgard proved this by renaming Windows Calculator to git.exe, which executed simply by opening the repo. _Developers evaluating AI coding tool risk can track disclosures like this one on daily.dev before opening untrusted repos._ ### Has Cursor patched the git.exe auto-execution vulnerability reported by Mindgard? No, as of the disclosure the flaw remained unpatched despite Mindgard first reporting it to Cursor on December 15 and following up multiple times over six months via email, LinkedIn, and a HackerOne bug bounty submission. Cursor never accepted the report or resolved it, prompting Mindgard to publish full details; a Cursor spokesperson later said the company was 'addressing this.' _Teams relying on Cursor for coding can follow patch status updates like this through daily.dev to time their mitigations._ ### How can I protect myself from the Cursor git.exe repository vulnerability until it's patched? Until Cursor ships a fix, open untrusted repositories only in an isolated VM, Windows Sandbox, or other disposable environment, and avoid relying on file hash blocklists since the malicious binary can be any renamed executable. Enterprise or managed Windows administrators can use AppLocker or Windows App Control policies to deny execution of git.exe from developer workspace directories. _Security-conscious developers weighing AI IDE risk can surface mitigation guidance like this via daily.dev._ ## Similar posts on daily.dev - [Cursor’s Unpatched Zero-Day Lets a Fake git.exe Hijack Any Windows Developer](https://daily.dev/posts/cursor-s-unpatched-zero-day-lets-a-fake-git-exe-hijack-any-windows-developer-risodnpvx) · Latest Hacking News · 9 upvotes · 4 comments - [Critical Cursor bug could turn routine Git into RCE](https://daily.dev/posts/critical-cursor-bug-could-turn-routine-git-into-rce-pedjrotwl) · CSO Online · 0 upvotes · 1 comments - [Sandbox bypass flaws in Cursor IDE highlight prompt injection as an RCE vector](https://daily.dev/posts/sandbox-bypass-flaws-in-cursor-ide-highlight-prompt-injection-as-an-rce-vector-fnfy3vrj6) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-coding](https://daily.dev/tags/ai-coding) [View this post on daily.dev](https://daily.dev/posts/cursor-ide-auto-executes-malicious-code-in-poisoned-repos-awzav5xbm) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Cursor IDE Auto-Executes Malicious Code in Poisoned Repos","url":"https://daily.dev/posts/cursor-ide-auto-executes-malicious-code-in-poisoned-repos-awzav5xbm","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cursor-ide-auto-executes-malicious-code-in-poisoned-repos-awzav5xbm"},"datePublished":"2026-07-14T13:04:07.415Z","dateModified":"2026-09-14T07:37:19.281Z","description":"A security vulnerability in the Cursor AI IDE allows automatic execution of malicious binaries when a developer opens a repository containing a poisoned...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e7bcf0d31ec67c73cbf1de2701b19efa?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e7bcf0d31ec67c73cbf1de2701b19efa?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cursor-ide-auto-executes-malicious-code-in-poisoned-repos-awzav5xbm","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-coding","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"Cursor IDE Auto-Executes Malicious Code in Poisoned Repos"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cursor-ide-auto-executes-malicious-code-in-poisoned-repos-awzav5xbm#faq","mainEntity":[{"@type":"Question","name":"How does the Cursor git.exe auto-execution vulnerability work?","acceptedAnswer":{"@type":"Answer","text":"Cursor searches multiple locations for Git binaries when loading a project, including the workspace root itself. If an attacker places a malicious file named git.exe at the repository root, Cursor automatically executes it during path resolution with no warning, approval prompt, or indication that repository code is running. Mindgard proved this by renaming Windows Calculator to git.exe, which executed simply by opening the repo. Developers evaluating AI coding tool risk can track disclosures like this one on daily.dev before opening untrusted repos."}},{"@type":"Question","name":"Has Cursor patched the git.exe auto-execution vulnerability reported by Mindgard?","acceptedAnswer":{"@type":"Answer","text":"No, as of the disclosure the flaw remained unpatched despite Mindgard first reporting it to Cursor on December 15 and following up multiple times over six months via email, LinkedIn, and a HackerOne bug bounty submission. Cursor never accepted the report or resolved it, prompting Mindgard to publish full details; a Cursor spokesperson later said the company was 'addressing this.' Teams relying on Cursor for coding can follow patch status updates like this through daily.dev to time their mitigations."}},{"@type":"Question","name":"How can I protect myself from the Cursor git.exe repository vulnerability until it's patched?","acceptedAnswer":{"@type":"Answer","text":"Until Cursor ships a fix, open untrusted repositories only in an isolated VM, Windows Sandbox, or other disposable environment, and avoid relying on file hash blocklists since the malicious binary can be any renamed executable. Enterprise or managed Windows administrators can use AppLocker or Windows App Control policies to deny execution of git.exe from developer workspace directories. Security-conscious developers weighing AI IDE risk can surface mitigation guidance like this via daily.dev."}}]} ```