CVE-2026-26268: A Malicious Git Repo Can Make Cursor's AI Agent Execute Arbitrary Code

Security researchers at Novee disclosed CVE-2026-26268 on April 28, 2026. It’s a high-severity arbitrary code execution vulnerability in Cursor with a CVSS score of 8.1. Cursor patched it in February 2026 under coordinated disclosure.

The vulnerability isn’t complicated. The attack surface is new, but the underlying mechanics are standard Git behavior.

How It Works

Git supports hooks: scripts that run automatically when you perform certain operations. A pre-commit hook runs before every commit. Git also supports bare repositories, which store version control data without a working tree.

The attack combines both. An attacker creates a legitimate-looking public repository that contains a nested bare repository with a hidden pre-commit hook. The hook holds malicious code. The outer repository looks clean. Standard git clone on the outer repo picks up the nested bare repo’s contents.

When Cursor’s AI agent performs a routine git checkout as part of a task, the pre-commit hook fires automatically. No pop-up. No warning. No user interaction required.

The agent’s code runs on your machine with your permissions, which means it has access to whatever you have access to: credentials, tokens, source code, environment variables, SSH keys.

Why This Class of Vulnerability Is New

In a traditional IDE, a pre-commit hook firing is almost never a problem. You cloned the repo, you chose to run git operations, and you’re making explicit decisions about what to run. The surface area is limited.

Cursor’s AI agent changes the model. You describe a task in natural language. The agent decides which git operations to run and executes them autonomously. When you ask it to “check out the feature branch and review the changes,” it runs git checkout without you thinking about it as a security-relevant operation.

That’s the root of CVE-2026-26268. The issue isn’t a bug in Cursor’s code. It’s a consequence of delegating git operations to an autonomous agent that doesn’t have the context to evaluate whether the repository it’s operating in is trustworthy.

The attack works on any developer who:

1. Uses Cursor’s AI agent for coding tasks
2. Clones a repository they don’t fully control (public repos, client code, open-source contributions, contractor work)
3. Asks the agent to do anything involving git operations in that repo

That’s a large percentage of the Cursor user base doing normal work.

Potential Impact

A compromised developer machine is a serious incident. Typical sensitive data on a developer workstation: API keys, OAuth tokens, AWS credentials, SSH private keys, database connection strings, proprietary source code, .env files with production secrets.

Beyond individual machines, developer workstations are a common pivot point for supply chain attacks. Code committed from a compromised machine can carry malicious changes forward into production systems.

Status

Cursor fixed this in February 2026. The patch predates the public disclosure by two months, which means current versions are not vulnerable. The GitHub security advisory is GHSA-8pcm-8jpx-hv8r.

If you’re on a current Cursor release, you’re not exposed. If you’re on an older version for any reason, update.

The Broader Pattern

This won’t be the last vulnerability of this type. As AI coding agents take over more git operations, file system operations, and network requests, they become a new attack surface in development workflows. The agent’s autonomy is the feature that makes it useful and the same property that makes it exploitable.

Supply chain attacks increasingly target developers rather than end users. A malicious package that runs arbitrary code during install, a crafted repository that exploits an AI agent’s git operations, a compromised dependency that exfiltrates credentials: these are all variations on the same theme. The target is whoever has access to production systems, and developers almost always do.

Vetting repositories before letting an AI agent operate in them isn’t glamorous advice, but it’s the right one for now.

Sources: Novee Security disclosure, hackread.com, cybersecuritynews.com, CSO Online