Critical Security Vulnerability in Cursor IDE
A major threat for software developers.
1Security Vulnerability in Cursor IDE
Cursor IDE can automatically execute a malicious git.exe file on Windows systems. This happens without user interaction and poses a significant security risk.
2Discovery of the Vulnerability
Discovered by Mindgard on December 15, 2025, this vulnerability was reported to Cursor's security email address. However, more than six months later, it remains unfixed.
3Simplicity of the Vulnerability
This security flaw does not require a complex attack chain. Simply opening a project containing a malicious git.exe file is enough.
4Cursor's Widespread Use
Cursor IDE has over 7 million active users and is used by more than 50,000 companies. This amplifies the impact of the vulnerability.
5Temporary Solutions
Temporary solutions can be implemented on Windows systems using AppLocker or Windows App Control policies. However, these are not permanent fixes.
6Cursor's Lack of Response
Mindgard attempted to communicate with Cursor for seven months but received no meaningful response. This raises questions about the company's security processes.
7Technical Details
When loading a project, Cursor searches for Git binaries in various locations. A malicious git.exe file is automatically executed during this process.
8Harmless Proof
Mindgard safely demonstrated this vulnerability by renaming the Windows Calculator application to git.exe. Cursor automatically executed this file.
9Real Attack Scenario
In a real attack, the Calculator could be replaced with attacker-controlled code. This results in arbitrary code execution under the user's privileges.
10Conclusion and Importance
This security vulnerability poses a significant threat to software developers. Cursor needs to urgently address this issue and inform its users.
Original article: Hacker News — Cursor IDE'de Kritik Güvenlik Açığı