--- title: Cursor’s Unpatched Zero-Day Lets a Fake git.exe Hijack... description: A zero-day vulnerability in Cursor, the AI coding IDE, allows a malicious git.exe placed in a repository's root folder to execute automatically on Windows when... canonical: https://daily.dev/posts/cursor-s-unpatched-zero-day-lets-a-fake-git-exe-hijack-any-windows-developer-risodnpvx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Cursor’s Unpatched Zero-Day Lets a Fake git.exe Hijack Any Windows Developer | daily.dev og:description: A zero-day vulnerability in Cursor, the AI coding IDE, allows a malicious git.exe placed in a repository's root folder to execute automatically on Windows when... og:url: https://daily.dev/posts/cursor-s-unpatched-zero-day-lets-a-fake-git-exe-hijack-any-windows-developer-risodnpvx og:image: https://api.daily.dev/og/posts/risodNpVx.png og:image:alt: Cursor’s Unpatched Zero-Day Lets a Fake git.exe Hijack Any Windows Developer og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Cursor’s Unpatched Zero-Day Lets a Fake git.exe Hijack Any Windows Developer **[Latest Hacking News](https://daily.dev/sources/lhn)** · 5 min read · 9 upvotes · 4 comments ## Summary A zero-day vulnerability in Cursor, the AI coding IDE, allows a malicious git.exe placed in a repository's root folder to execute automatically on Windows when a developer opens the project — no user interaction required. Mindgard disclosed the flaw after seven months of no response from Cursor following responsible disclosure in December 2025. The same unsafe binary resolution pattern was found in GitHub Copilot CLI, Google Gemini CLI, and OpenAI Codex. AWS's Kiro had a related issue that was patched (CVE-2026-10591), highlighting a stark contrast in vendor responsiveness. With over 7 million active Cursor users, the unpatched bug poses real risk to developers who clone unfamiliar repositories. Mitigations include opening unknown repos in sandboxed environments, checking for unexpected executables in repo roots, and using AppLocker or Windows App Control policies. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the Cursor git.exe vulnerability on Windows and has it been patched? Cursor resolves the Git binary by checking several locations including the workspace root itself, so a file named git.exe placed at the top level of a cloned repository runs automatically the moment the folder is opened, with no prompt. Mindgard reported this to Cursor on December 15, 2025, and as of the July 14, 2026 public disclosure it remained unpatched, with no CVE assigned and no advisory published. _Anyone relying on Cursor for daily work can follow the disclosure timeline and mitigations on daily.dev before opening another unfamiliar clone._ ### Which AI coding tools besides Cursor are affected by unsafe git.exe resolution on Windows? Cymulate's research found the same unsafe binary-resolution pattern in GitHub Copilot CLI, Google's Gemini CLI, and OpenAI's Codex app, each executing a planted git.exe or similar tool from the workspace before any trust check. AWS's Kiro had a related but distinct flaw, arbitrary command execution via a poisoned .vscode/tasks.json, which was assigned CVE-2026-10591 (CVSS 8.8) and fixed in version 0.11. _Developers comparing AI coding assistants can weigh vendor security responses like these alongside daily.dev's coverage before picking a tool._ ### How should developers protect themselves from a malicious git.exe in a cloned repository until Cursor issues a fix? Treat any outside repository as untrusted input to the IDE itself, not just the code inside it. Open unfamiliar clones in a disposable VM or Windows Sandbox, check the repository root for unexpected executables such as git.exe, npx.exe, node.exe, or where.exe before opening elsewhere, and use AppLocker or Windows App Control deny rules to block execution from workspace paths. _Teams hardening their AI-assisted git workflows can track mitigation guidance like this through daily.dev as the situation develops._ ## Community discussion Top comments from developers on daily.dev. **@akashskypatel** · 4 upvotes > Wonder if the $60b buyout still looks good Lol **@yetzederixx** · 0 upvotes > Glad I quit using this months ago, and finally uninstalled after they were acquired hahaha **@rizzdev** · 0 upvotes > kiro got a cve for basically the same bug and cursor just closed theirs out of scope. seven months ago now **@kartiknvj** · 0 upvotes > What stands out is that the agent inherits the developer's full local environment and PATH, and almost nobody treats that as a trust boundary. Anything an editor agent can shell out to should be resolved from an absolute path and pinned, otherwise every helper binary on the machine is an injection point. Is anyone sandboxing the agent's shell separately from their own terminal yet? ## Similar posts on daily.dev - [Critical Cursor bug could turn routine Git into RCE](https://daily.dev/posts/critical-cursor-bug-could-turn-routine-git-into-rce-pedjrotwl) · CSO Online · 0 upvotes · 1 comments - [Cursor IDE Vulnerabilities Let Prompt Injection Escape the Sandbox](https://daily.dev/posts/cursor-ide-vulnerabilities-let-prompt-injection-escape-the-sandbox-gf53uatdq) · Latest Hacking News · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#windows](https://daily.dev/tags/windows), [#ai-coding](https://daily.dev/tags/ai-coding) [View this post on daily.dev](https://daily.dev/posts/cursor-s-unpatched-zero-day-lets-a-fake-git-exe-hijack-any-windows-developer-risodnpvx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Cursor’s Unpatched Zero-Day Lets a Fake git.exe Hijack Any Windows Developer","url":"https://daily.dev/posts/cursor-s-unpatched-zero-day-lets-a-fake-git-exe-hijack-any-windows-developer-risodnpvx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cursor-s-unpatched-zero-day-lets-a-fake-git-exe-hijack-any-windows-developer-risodnpvx"},"datePublished":"2026-07-26T19:12:34.999Z","dateModified":"2026-09-13T18:41:24.305Z","description":"A zero-day vulnerability in Cursor, the AI coding IDE, allows a malicious git.exe placed in a repository's root folder to execute automatically on Windows when...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/332bc69701fd71fee21eac32e1ff77d2?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/332bc69701fd71fee21eac32e1ff77d2?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Latest Hacking News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Latest Hacking News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/5110318ded6e43f1bb12facdeb2b1965","url":"https://daily.dev/sources/lhn"},"commentCount":4,"discussionUrl":"https://daily.dev/posts/cursor-s-unpatched-zero-day-lets-a-fake-git-exe-hijack-any-windows-developer-risodnpvx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":9},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":4}],"keywords":"security,windows,ai-coding","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Latest Hacking News","item":"https://daily.dev/sources/lhn"},{"@type":"ListItem","position":3,"name":"Cursor’s Unpatched Zero-Day Lets a Fake git.exe Hijack Any Windows Developer"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/cursor-s-unpatched-zero-day-lets-a-fake-git-exe-hijack-any-windows-developer-risodnpvx","comment":[{"@type":"Comment","text":"Wonder if the $60b buyout still looks good Lol","datePublished":"2026-07-26T21:46:52.725Z","url":"https://daily.dev/posts/risodNpVx#c-HfxWWHg9F","author":{"@type":"Person","name":"Akash","url":"https://daily.dev/akashskypatel","image":"https://avatars.githubusercontent.com/u/8129618?v=4"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4}},{"@type":"Comment","text":"Glad I quit using this months ago, and finally uninstalled after they were acquired hahaha","datePublished":"2026-07-29T20:54:18.806Z","url":"https://daily.dev/posts/risodNpVx#c-HfNW7mP9l","author":{"@type":"Person","name":"Jared","url":"https://daily.dev/yetzederixx","image":"https://lh3.googleusercontent.com/a/ACg8ocJE7F397eAJcrTtLk_RhHueRbehoNCm6rDryyZ_dkCRVWVh4wYd=s96-c"}},{"@type":"Comment","text":"kiro got a cve for basically the same bug and cursor just closed theirs out of scope. seven months ago now","datePublished":"2026-07-31T00:25:46.204Z","url":"https://daily.dev/posts/risodNpVx#c-KuGTf3EAu","author":{"@type":"Person","name":"Andrew","url":"https://daily.dev/rizzdev","image":"https://media.daily.dev/image/upload/s--35vRfXAA--/f_auto/v1785413727/avatars/avatar_fQ7ttCKtPuu6tDvcgQXv5?_a=BAMAMicg0"}},{"@type":"Comment","text":"What stands out is that the agent inherits the developer’s full local environment and PATH, and almost nobody treats that as a trust boundary. Anything an editor agent can shell out to should be resolved from an absolute path and pinned, otherwise every helper binary on the machine is an injection point. Is anyone sandboxing the agent’s shell separately from their own terminal yet?","datePublished":"2026-07-27T18:44:39.587Z","url":"https://daily.dev/posts/risodNpVx#c-G2NdNfEbp","author":{"@type":"Person","name":"kartik-nvjk","url":"https://daily.dev/kartiknvj","image":"https://media.daily.dev/image/upload/s--3gGgsVCw--/f_auto/v1781456774/avatars/avatar_TvTVeiMdkRCqWUDullFmy?_a=BAMAMiWQ0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cursor-s-unpatched-zero-day-lets-a-fake-git-exe-hijack-any-windows-developer-risodnpvx#faq","mainEntity":[{"@type":"Question","name":"What is the Cursor git.exe vulnerability on Windows and has it been patched?","acceptedAnswer":{"@type":"Answer","text":"Cursor resolves the Git binary by checking several locations including the workspace root itself, so a file named git.exe placed at the top level of a cloned repository runs automatically the moment the folder is opened, with no prompt. Mindgard reported this to Cursor on December 15, 2025, and as of the July 14, 2026 public disclosure it remained unpatched, with no CVE assigned and no advisory published. Anyone relying on Cursor for daily work can follow the disclosure timeline and mitigations on daily.dev before opening another unfamiliar clone."}},{"@type":"Question","name":"Which AI coding tools besides Cursor are affected by unsafe git.exe resolution on Windows?","acceptedAnswer":{"@type":"Answer","text":"Cymulate's research found the same unsafe binary-resolution pattern in GitHub Copilot CLI, Google's Gemini CLI, and OpenAI's Codex app, each executing a planted git.exe or similar tool from the workspace before any trust check. AWS's Kiro had a related but distinct flaw, arbitrary command execution via a poisoned .vscode/tasks.json, which was assigned CVE-2026-10591 (CVSS 8.8) and fixed in version 0.11. Developers comparing AI coding assistants can weigh vendor security responses like these alongside daily.dev's coverage before picking a tool."}},{"@type":"Question","name":"How should developers protect themselves from a malicious git.exe in a cloned repository until Cursor issues a fix?","acceptedAnswer":{"@type":"Answer","text":"Treat any outside repository as untrusted input to the IDE itself, not just the code inside it. Open unfamiliar clones in a disposable VM or Windows Sandbox, check the repository root for unexpected executables such as git.exe, npx.exe, node.exe, or where.exe before opening elsewhere, and use AppLocker or Windows App Control deny rules to block execution from workspace paths. Teams hardening their AI-assisted git workflows can track mitigation guidance like this through daily.dev as the situation develops."}}]} ```