CVE-2026-63093: Cursor for Windows ran a git.exe planted in a cloned repo as soon as you opened it
On Windows, Cursor 3.2.16 looked up git by name, so a malicious git.exe in the root of a repo you cloned and opened ran automatically at startup and repeatedly after that, with no extra click. Cursor says 3.13.25 and later fix it. macOS and Linux were not affected.
What it is
CVE record (assigned by VulnCheck, found by Mindgard): Cursor for Windows 3.2.16 has a binary-planting flaw (CWE-426, untrusted search path). Cursor resolves and runs a workspace-resident git.exe during IDE startup and on a recurring timer, as the current user, without any user interaction. CVSS 4.0 8.7.
The CVE record and GitHub's advisory database list no patched version. Cursor's forum post first called the report out of scope for its bug bounty, said it affects Windows only when the project root contains a file named exactly git.exe, and pointed to Workspace Trust. It also said Cursor hadn't kept the researcher updated in time.
Cursor's August 2026 update to that post: IDE operations now resolve Git themselves and spawn it by a validated absolute path, and candidates in (or above) the working directory are rejected. A planted git.exe no longer runs when you open the folder. Users should update to Cursor 3.13.25 or later.
How to check
- On Windows: Cursor → About should show 3.13.25 or later.
- Before opening a repo from someone you don't know, check its root (and parent folders) for an unexpected git.exe or other .exe files.
- Check whether Workspace Trust is on, so unfamiliar folders open in restricted mode.
How to fix
- Update Cursor for Windows to 3.13.25 or later.
- Turn on Workspace Trust (organisations can enforce it through MDM) and open untrusted repos in restricted mode or in a VM or container.
- If you opened an untrusted repo with a git.exe in it on an older version, treat the machine as compromised: scan it and rotate credentials that were on it.
# Look for executables in a repo before opening it in your editor
Get-ChildItem -Path . -Recurse -Include git.exe,*.exe,*.bat,*.cmd -File -ErrorAction SilentlyContinue | Select-Object FullName