Image: Mindgard / mindgard.ai A Security Firm Reported a Cursor Zero-Day in December. Cursor Never Responded. So They Published It.
Mindgard disclosed a Windows code-execution flaw in Cursor after seven months of silence from the company. The bug lets malicious repositories run arbitrary code the moment you open a project. There's still no CVE and no official advisory.
On July 14, AI security firm Mindgard published full technical details on a vulnerability in Cursor that lets a malicious repository execute arbitrary code on Windows the moment you open the project in the IDE. No clicks. No warnings. No approval dialogs.
They’d reported it to Cursor seven months earlier.
The vulnerability
When Cursor loads a project on Windows, it searches for a Git binary in several locations. One of those locations is the workspace root itself — the folder you just opened. Windows command resolution searches the current directory before system paths, so if a repository contains a file named git.exe in its root, Cursor finds it and runs it.
The attack is straightforward. A malicious actor commits a git.exe to a public repository — renaming Windows Calculator works as a proof of concept. A developer clones the repo, opens it in Cursor, and the binary runs with their privileges. SSH keys, cloud credentials, and source code are all accessible.
Mindgard researcher Aaron Portnoy described it directly: “There are no clicks, prompts, approval dialogs, or warnings. The result is arbitrary code execution.”
Seven months of silence
Mindgard reported the vulnerability to Cursor’s security team on December 15, 2025. What followed was a long stretch of nothing.
They submitted to HackerOne in January 2026. The report was initially closed as “Informative and out of scope.” Mindgard objected; HackerOne confirmed the issue was reproducible and reopened it. After that, Cursor stopped responding — no status updates through February, March, or April despite repeated requests.
Mindgard publicly announced their intention to disclose in June. Cursor’s CISO acknowledged earlier that an internal automation failure had prevented their HackerOne workflow from functioning properly. That’s the last substantive communication Mindgard received.
The disclosure went out July 14-15 with full technical details, proof-of-concept code, and the complete timeline of non-communication.
Where the patch stands
This is where the story gets murky. When Mindgard published, their most recent test was against Cursor 3.2.16 from April 30, 2026 — not the current version. Some reporting from July 17 indicates Cursor quietly shipped a fix around July 13, one day before the public disclosure.
If that’s accurate, Cursor patched the bug on the day before full disclosure without telling anyone: no changelog entry, no CVE, no security advisory, no version bump announcement. Cursor has not confirmed or denied the patch.
As of the disclosure date, there is no CVE assigned to this vulnerability.
Scale
Cursor says it has more than 7 million active users, more than 1 million daily actives, and more than 1 million paying subscribers across 50,000 companies. All Windows users are potentially affected. macOS and Linux are not vulnerable.
This isn’t the first significant security issue in Cursor this year. In May, CVE-2026-26268 disclosed a separate arbitrary code execution path through malicious Git hooks that Cursor patched in February under coordinated disclosure with Novee Security. That one had a CVE. This one doesn’t.
Sources: Mindgard — The Hacker News — Dark Reading