Cursor IDE Binary Planting Flaw Enables Zero-Click Code Execution
A critical binary planting vulnerability in the Cursor IDE (CVE-2026-63093, CVSS 8.7) allows attackers to execute arbitrary code when a developer opens a malicious repository on Windows. The flaw, disclosed by Mindgard on July 14, 2026, stems from Cursor’s method of locating the git.exe binary during project loading.
When opening a repository, Cursor searches for git.exe in multiple locations, including the workspace root. If a malicious file named git.exe is planted there and no legitimate binary exists in trusted system paths Windows executes the attacker’s file automatically under the logged-in user’s privileges. The attack requires no user interaction, prompts, or prior access to the victim’s machine.
Mindgard demonstrated the flaw by replacing git.exe with a renamed Windows Calculator app, which launched immediately upon opening the repository. The issue extends beyond git.exe: Cursor also searches for hatch.exe when a pyproject.toml file is present, using the same insecure resolution logic. Unlike more conspicuous execution methods (e.g., tasks.json), pyproject.toml files appear benign, making this a stealthier attack vector.
Workspace Trust, a security feature meant to block execution in untrusted folders, proved ineffective. Testing on Trae IDE (which enables Workspace Trust by default) showed the IDE still attempts to locate git.exe in untrusted workspaces. Cursor ships with Workspace Trust disabled by default, meaning code execution can occur without any user confirmation when opening a folder.
The vulnerability was reported to Cursor on December 15, 2025, but the company initially dismissed it as out of scope for its bug bounty program, citing a shared-responsibility model. Cursor later addressed the issue on July 13, 2026, just before Mindgard’s public disclosure though no formal security advisory was issued.
The flaw is part of a broader attack surface in AI-powered IDEs, including unpatched Chromium vulnerabilities in outdated Electron builds affecting Cursor and Windsurf, impacting an estimated 1.8 million developers. Other recent Cursor vulnerabilities, such as CVE-2026-50548 and CVE-2026-50549 (DuneSlide), enabled sandbox escape and OS-level remote code execution via prompt injection, patched in Cursor 3.0.
The incident highlights risks in binary resolution logic and the assumption that only specific filenames (e.g., git.exe) pose threats. Attackers can exploit any executable file in a workspace if it aligns with the IDE’s search behavior.
Source: https://cybersecuritynews.com/cursor-0-day-vulnerability/
Windsurf TPRM report: https://www.rankiteo.com/company/amazingly-–-ai-code-reviews-for-vscode-cursor-windsurf-trae
Cursor TPRM report: https://www.rankiteo.com/company/anysphereinc
Trae IDE TPRM report: https://www.rankiteo.com/company/marscodeworld
"id": "maranyama1787135211",
"linkid": "marscodeworld, anysphereinc, amazingly-–-ai-code-reviews-for-vscode-cursor-windsurf-trae",
"type": "Vulnerability",
"date": "7/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Estimated 1.8 million '
'developers',
'industry': 'Software Development',
'location': 'Global',
'name': 'Cursor IDE',
'type': 'Software (AI-powered IDE)'}],
'attack_vector': 'Malicious repository with planted executable files (e.g., '
'`git.exe`, `hatch.exe`)',
'date_detected': '2025-12-15',
'date_publicly_disclosed': '2026-07-14',
'date_resolved': '2026-07-13',
'description': 'A critical binary planting vulnerability in the Cursor IDE '
'(CVE-2026-63093, CVSS 8.7) allows attackers to execute '
'arbitrary code when a developer opens a malicious repository '
'on Windows. The flaw stems from Cursor’s method of locating '
'the `git.exe` binary during project loading, where it '
'searches for the binary in multiple locations, including the '
'workspace root. If a malicious file named `git.exe` is '
'planted there, Windows executes it automatically under the '
'logged-in user’s privileges without any user interaction. The '
'issue also extends to `hatch.exe` when a `pyproject.toml` '
'file is present, using the same insecure resolution logic. '
'Workspace Trust, a security feature, proved ineffective in '
'preventing this attack.',
'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
'security flaws in a developer tool',
'operational_impact': 'Arbitrary code execution under user '
'privileges',
'systems_affected': 'Cursor IDE on Windows systems'},
'investigation_status': 'Resolved',
'lessons_learned': 'The incident highlights risks in binary resolution logic '
'and the assumption that only specific filenames (e.g., '
'`git.exe`) pose threats. Attackers can exploit any '
'executable file in a workspace if it aligns with the '
'IDE’s search behavior. Workspace Trust features may not '
'be sufficient to prevent such attacks.',
'post_incident_analysis': {'corrective_actions': 'Cursor patched the '
'vulnerability by fixing the '
'binary resolution logic. '
'Users are advised to update '
'to the latest version and '
'enable Workspace Trust.',
'root_causes': 'Insecure binary resolution logic '
'in Cursor IDE, which searches for '
'executables like `git.exe` and '
'`hatch.exe` in untrusted workspace '
'directories. Workspace Trust '
'feature was ineffective in '
'preventing execution.'},
'recommendations': 'Developers should ensure Workspace Trust is enabled and '
'verify the integrity of executables in project '
'directories. IDE vendors should audit binary resolution '
'logic and enforce stricter security defaults.',
'references': [{'source': 'Mindgard'}],
'response': {'communication_strategy': 'No formal security advisory issued; '
'public disclosure by Mindgard',
'containment_measures': 'Patch released to address the binary '
'planting vulnerability',
'remediation_measures': 'Fixed insecure binary resolution logic '
'in Cursor IDE'},
'title': 'Cursor IDE Binary Planting Flaw Enables Zero-Click Code Execution',
'type': 'Binary Planting Vulnerability',
'vulnerability_exploited': 'CVE-2026-63093'}