Cursor IDE Zero-Day: 7 Months, 197 Versions, Zero Replies on a $60B AI IDE

Key Points

• The vulnerability: On Windows, Cursor scans the workspace root for a Git binary during project loading. Anyone who can place a malicious git.exe in a repository gets zero-click RCE under the developer's user account, triggered by routine IDE operations such as git rev-parse --show-toplevel. Compromised assets include API keys, .env files, SSH keys, local databases, and full workstation access.
• Disclosure timeline (per Mindgard):
• 2025-12-15: Vulnerability submitted to Cursor via HackerOne.
• 2026-01-15: Cursor's CISO manually added the researcher to the bug bounty program, citing an "automation failure."
• 2026-01-16: Report closed as out-of-scope, then re-opened after challenge.
• 2026-02 to 2026-06: Multiple follow-ups, no replies.
• 2026-06-01: Mindgard publicly disclosed intent to publish.
• 2026-07-14: Full public disclosure. The flaw still existed in v3.2.16 (tested April 30).
• No CVE was assigned because the report never entered formal CVE channels.
• Why this matters organizationally: Cursor reportedly has 7M+ monthly active users, 1M+ paid users, 50,000+ enterprise customers, and a $60B valuation—second only to GitHub Copilot in AI coding. A trivial search-path bug surviving 197 releases points to a broken security pipeline: reports not flowing through normal channels, triage mis-classifying issues as out-of-scope, and no SLA on researcher follow-ups. The April 2026 DuneSlide sandbox-escape flaw (CVE-2026-50548/50549, CVSS 9.8) was patched in Cursor 3.0, showing the team is capable of fixing bugs when they choose to. The likely explanation: classic IDE security issues were deprioritized below AI/Agent concerns.
• Why this matters for the industry: This is the first "zero-day + public disclosure + vendor silence" trifecta for an AI coding tool. It contrasts with the July 13, 2026 Grok CLI incident (silently uploading code and secrets), which threatened user data. The Cursor bug threatens the user's machine itself. AI coding tools ship a much larger attack surface than traditional IDEs, yet vendor security maturity has not kept pace.
• Mitigations (from Mindgard):
• Enterprise / managed Windows: Use AppLocker or Windows App Control with path-based rules (e.g., %USERPROFILE%\source\repos*\filename.exe) to block workspace executables. Do not rely on hash blocklists—attackers can ship a new hash per target.
• Individual developers: Open untrusted repositories only in isolated environments (Windows Sandbox, VM, ephemeral container).
• Don't rely on hash blocks: Each attacker's binary differs.
• Open questions and risks:
• Will Cursor publicly patch, or silently add a path filter? Silence is reputational risk for a $60B-product company.
• MITRE may eventually assign a CVE, turning this into a long-cited case study in failed coordinated disclosure.
• Exploitation window is roughly 24–72 hours post-disclosure; multiple malicious git.exe PoCs are already on GitHub.
• Likely no short-term ARR impact due to switching costs, but enterprise CISOs may add Cursor to vendor-audit-required lists, lengthening sales cycles.
• The same search-path pattern is common across WindSurf, Cline, Roo Code, Continue, Zed AI, and others. Cursor's disclosure effectively performs a free penetration test for the whole AI IDE category.

Sources

• Mindgard primary disclosure: https://mindgard.ai/blog/cursor-0day-when-full-disclosure-becomes-the-only-protection-left
• Cybersecurity News: https://cybersecuritynews.com/cursor-ai-coding-agent-vulnerability/
• byteiota: https://byteiota.com/cursor-ide-rce-unpatched-git-exe
• 163 Tech: https://www.163.com/dy/article/L1RO4LPV05561FZH.html
• Developers Digest: https://www.developersdigest.tech/blog/cursor-0day-git-exe-vulnerability