Cursor Mindgard drops a Cursor zero-day after seven months of vendor silence
Mindgard disclosed an unpatched Cursor flaw: opening a repository that contains a malicious git.exe in its root makes the editor run it automatically on Windows, with no prompt. The firm reported it in December and went public after seven months of vendor silence.
Security firm Mindgard has published a full-disclosure writeup of an unpatched flaw in Cursor, the AI-assisted editor: on Windows, opening a repository that contains a malicious git.exe in its root causes Cursor to execute that binary automatically, with no click, prompt, or approval. The firm says it reported the bug in December 2025 and, after seven months and more than 197 releases with no fix and no meaningful response, decided that coordinated disclosure had nothing left to coordinate. For a tool whose whole job is to open other people’s code, silent code execution plus a vendor that went quiet is the story.
What the disclosure describes
The vulnerability lives in how Cursor finds the git executable. When it loads a project, it searches several locations for a git binary, and one of those locations is the workspace itself. An attacker who plants a git.exe in the root of a repository gets it run automatically as part of Cursor’s path-resolution logic, in Mindgard’s words “without warning, approval, or even an indication that executable content from the repository is about to run.” To demonstrate it safely, the researchers renamed the Windows Calculator to git.exe, dropped it in a repo root, and watched Cursor re-execute it while the project stayed open.
Mindgard reports the issue is present through at least version 3.2.16, tested at the end of April 2026, and remained unaddressed across the releases that followed. No CVE has been assigned.
The reason this matters to a working developer is that opening an unfamiliar repository is an ordinary, low-suspicion act. You clone a dependency to read it, check out a colleague’s branch, or open a sample project to try it. This flaw turns “open this folder” into “run whatever binary the folder’s author chose,” which inverts the trust model people carry into an editor. An IDE that quietly runs tooling on your behalf, git included, has quietly widened what a hostile repository can do to you.
The disclosure fight
The timeline is the other half of the story. Mindgard says it identified and reported the flaw on December 15, 2025, then routed it through Cursor’s HackerOne program in mid-January, where it was first closed as “informative and out of scope” before being reopened. After that came months of unanswered update requests and, by Mindgard’s account, no remediation timeline and no communication to users. In June the firm notified HackerOne of its intent to disclose, and on July 14 it published. Its framing is blunt: “coordinated disclosure only works when there is coordination,” and with no evidence of a fix after seven months, “withholding information no longer serves users, it serves silence.”
Cursor sits at real scale, which is what gives the standoff its weight. Mindgard cites more than seven million active users and a reported valuation around 60 billion dollars. This is also not the only code-execution path researchers have flagged in AI editors this year, which makes the responsiveness question larger than any single bug: as these tools race to ship, the speed of their security triage is starting to lag the speed of their releases.
Where this lands in the market
The uncomfortable pattern here is that AI editors are built to act, and acting means executing things. They run linters, git, language servers, and increasingly external tool servers on your behalf, so the surface exposed by simply opening a project keeps growing while the mental model of “an editor just shows me text” stays stuck in the past. When a vendor moving at AI speed cannot keep its disclosure process moving at the same pace, full disclosure stops being a fringe tactic and starts looking like the only lever a researcher has left. For teams choosing an agentic editor, a vendor’s security responsiveness now belongs on the evaluation sheet next to model quality and price.
What’s worth watching
- Whether Cursor ships a fix and a CVE now that it is public. Public disclosure usually forces both. The signal to watch is how fast a patch lands and whether the workspace-binary execution gets closed off by default.
- Whether AI editors sandbox workspace binaries generally. The clean fix is to stop trusting executables that live inside an untrusted repository. Watch whether that becomes a default across the category, not just a one-off patch.
- Whether full disclosure becomes the norm against fast-moving AI vendors. If triage keeps lagging releases, more researchers will reach for the same lever, and the reputational cost of silence goes up.
The plain takeaway is that an editor that runs code on your behalf carries the security obligations of software that runs code, and answering a researcher is part of that obligation, not a courtesy. Cursor has the disclosure now whether it engaged or not. Stackmaven’s follow-up coverage will revisit whether a fix and a CVE arrive, and whether the category moves to sandbox workspace binaries by default, on or around October 13.