# Critical Security Vulnerability in Cursor IDE A major threat for software developers. - **Source:** [Hacker News](https://news.ycombinator.com) - **Published:** 2026-07-14 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/64dcecbf-1f16-45a1-99a3-e1b2d574be71 ## Security Vulnerability in Cursor IDE Cursor IDE can automatically execute a malicious git.exe file on Windows systems. This happens without user interaction and poses a significant security risk. ## Discovery of the Vulnerability Discovered by Mindgard on December 15, 2025, this vulnerability was reported to Cursor's security email address. However, more than six months later, it remains unfixed. ## Simplicity of the Vulnerability This security flaw does not require a complex attack chain. Simply opening a project containing a malicious git.exe file is enough. ## Cursor's Widespread Use Cursor IDE has over 7 million active users and is used by more than 50,000 companies. This amplifies the impact of the vulnerability. ## Temporary Solutions Temporary solutions can be implemented on Windows systems using AppLocker or Windows App Control policies. However, these are not permanent fixes. ## Cursor's Lack of Response Mindgard attempted to communicate with Cursor for seven months but received no meaningful response. This raises questions about the company's security processes. ## Technical Details When loading a project, Cursor searches for Git binaries in various locations. A malicious git.exe file is automatically executed during this process. ## Harmless Proof Mindgard safely demonstrated this vulnerability by renaming the Windows Calculator application to git.exe. Cursor automatically executed this file. ## Real Attack Scenario In a real attack, the Calculator could be replaced with attacker-controlled code. This results in arbitrary code execution under the user's privileges. ## Conclusion and Importance This security vulnerability poses a significant threat to software developers. Cursor needs to urgently address this issue and inform its users. ## Sources covering this story - https://mindgard.ai/blog/cursor-0day-when-full-disclosure-becomes-the-only-protection-left — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._