Cursor AI code editor 0-day allows code execution from poisoned repositories
Cursor AI's code editor contained an unpatched 0-day vulnerability allowing arbitrary code execution from poisoned repositories on Windows. The vendor reportedly ignored the disclosure for five months before making a vague public acknowledgment.
What happened
Mindgard disclosed a 0-day vulnerability in Cursor where a poisoned repository could trigger arbitrary code execution on Windows systems. The flaw exists in how Cursor resolves Git binaries when a project loads: Cursor checks several locations for git, including the workspace itself, and if a file called git.exe is placed at the root of a repository, Cursor executes it automatically when the project opens.
Mindgard first reported the bug on December 15, 2025, but Cursor did not respond. After a public LinkedIn post, Cursor's CISO replied privately, blaming a broken automation for the missed HackerOne invite. The initial HackerOne report was closed as 'informative and out of scope,' then reopened after Mindgard pushed back. Despite requests for updates in February, March, and April, Cursor provided no response for five months.
Reported impact
Cursor is used by more than half of Fortune 500 companies. The vulnerability exposes developers to arbitrary code execution attacks when opening repositories.
Index analysis
The issue exemplifies risks in AI-powered development tools that are designed to automate tasks and execute commands, including writing code, executing terminal commands, modifying files, and interacting with version control. Sandboxing an AI agent is fundamentally harder than sandboxing a static application because the agent is supposed to interact with the system in complex, context-dependent ways.
Governance controls
Cursor failed to respond to responsible disclosure over five months. An unnamed Cursor spokesperson later told Dark Reading that 'I can confirm we are addressing this and will get back to Mindgard accordingly,' but provided no timeline or confidence-instilling detail.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.