Clone a repository. Open it in Cursor. That's it
no click, no approval dialog, no warning. If the repo has a file named git.exe sitting in its root, Cursor just ran it as you.
A zero-day in Cursor's Windows Git path resolution lets a poisoned repository trigger automatic code execution the moment it's opened. It was reported to Cursor on December 15, 2025. It is still unpatched, seven months later, with no CVE and no advisory.
WHAT ACTUALLY HAPPENED
When Cursor loads a project, it searches multiple locations for a Git binary, including the workspace folder itself. Plant a file called git.exe in a repository's root, and Cursor's path resolution executes it automatically — no prompt, no sandboxing, no sign that executable content is about to run. AI security firm Mindgard disclosed the flaw privately in December, waited seven months for a fix that never shipped, then published full technical details this week, arguing that silence was no longer protecting anyone. Whatever that binary does, it does with your privileges — your source code, your SSH keys, your cloud tokens, all reachable the instant the folder opens.
WHY AN AI CODING TOOL BEING THE ATTACK SURFACE CHANGES THE MATH
Developers already trust code editors more than almost any other application on their machine — that trust is exactly what makes an IDE the highest-value place to hide an exploit. Cloning a repo to review a pull request or evaluate a dependency is routine, done dozens of times a week without a second thought. This bug turns that routine action into unauthenticated code execution, with zero interaction beyond opening a folder. The seven-month gap between private disclosure and a patch is its own signal: coordinated disclosure only protects users if the vendor actually ships a fix inside a reasonable window, not indefinitely.
WHAT TO DO NOW
DO NOT OPEN UNTRUSTED REPOSITORIES IN CURSOR ON WINDOWS UNTIL THIS IS PATCHED — treat any repo you didn't author as hostile until Cursor confirms a fix.
INSPECT REPOSITORIES FOR A ROOT-LEVEL GIT.EXE BEFORE OPENING THEM — it is a single, checkable indicator of this specific attack.
USE A DISPOSABLE VM OR CONTAINER TO REVIEW UNKNOWN CODE — isolate the review environment from your real SSH keys and cloud credentials entirely.
TRACK VENDOR DISCLOSURE TIMELINES, NOT JUST CVE FEEDS — a serious flaw with no CVE and no advisory doesn't mean it doesn't exist; it means disclosure broke down.
The editor you trust to review code safely just became the thing that needed reviewing. Seven months of silence is not a patching delay — it's a decision.
Do you vet AI coding tools and IDE extensions with the same scrutiny you apply to production dependencies?