CVE-2026-26268: 
NixOS vulnerability analysis and mitigation

CVE-2026-26268 is a sandbox escape vulnerability in Cursor, the AI-powered code editor developed by Anysphere, affecting all versions prior to 2.5. A malicious agent — such as one introduced via prompt injection — could write to improperly protected .git configuration files, including git hooks, enabling out-of-sandbox remote code execution (RCE) the next time those hooks are triggered by Git automatically. The vulnerability was published on February 13, 2026, and fixed in Cursor version 2.5. The GitHub Security Advisory assigns a CVSS v3.1 score of 8.0 (High), while Feedly's threat intelligence estimates a score of 9.9 (Critical) based on a broader vector assessment (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization): Cursor's sandbox failed to adequately restrict write access to .git directory contents, including git hooks such as pre-commit, post-checkout, or post-merge (GitHub Advisory). An attacker leveraging prompt injection against Cursor's AI agent could instruct the agent to write malicious shell commands into these hook files. Because Git executes hook scripts automatically during routine operations (e.g., commits, checkouts, merges), the payload runs outside the sandbox without any additional user interaction. The attack vector is network-based, as the malicious instructions can originate from a remote source such as a crafted repository, a malicious file opened in the editor, or injected content in an AI prompt. Credit for discovery goes to the Novee Security Research Team, Daniel Teixeira (Nvidia AI Red Team), and Philip Tsukerman (GitHub Advisory).

Successful exploitation results in full compromise of the developer's host machine, escaping the Cursor sandbox to achieve arbitrary code execution with the privileges of the user running Cursor. This exposes confidentiality (access to source code, credentials, API keys, SSH keys, and other sensitive files on the developer's system), integrity (ability to modify code, inject backdoors into projects), and availability (potential for destructive actions or ransomware-style attacks). Because developers often have access to CI/CD pipelines, cloud credentials, and internal infrastructure, exploitation could facilitate significant lateral movement and supply chain compromise (GitHub Advisory, CSO Online).

As of the time of reporting, there is no public proof-of-concept exploit code and no confirmed evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.036%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. However, the zero-user-interaction requirement and the automatic nature of Git hook execution make this vulnerability particularly dangerous if weaponized, especially in developer environments where AI coding agents are widely trusted. The vulnerability has been detected by Nessus (plugin ID 299665) (Tenable).

1. Reconnaissance: Identify a target developer using Cursor IDE versions prior to 2.5, either through public profiles, job postings, or by crafting a malicious repository likely to be opened with Cursor's AI agent.
2. Craft a prompt injection payload: Prepare malicious content (e.g., in a README, code comment, or data file) designed to be processed by Cursor's AI agent. The payload instructs the agent to write attacker-controlled commands into a git hook file (e.g., .git/hooks/post-checkout or .git/hooks/pre-commit).
3. Deliver the payload: Host the malicious repository or file where the target developer is likely to open it in Cursor — for example, via a pull request, a shared repository link, or a crafted file attachment.
4. Agent writes malicious hook: When the developer opens the project in Cursor and the AI agent processes the injected content, the agent writes a malicious shell script (e.g., a reverse shell or credential exfiltration command) into the .git/hooks/ directory, bypassing sandbox restrictions due to missing authorization controls.
5. Trigger automatic execution: The next time the developer performs a routine Git operation (commit, checkout, merge, pull), Git automatically executes the hook script outside the Cursor sandbox, achieving RCE on the developer's host machine with their user privileges.
6. Post-exploitation: The attacker can establish persistence, exfiltrate credentials or source code, pivot to connected cloud environments or CI/CD systems, or inject backdoors into the developer's codebase (GitHub Advisory, CSO Online).

• File System: Unexpected or recently modified files in .git/hooks/ (e.g., pre-commit, post-checkout, post-merge, post-receive) containing shell commands not placed there by the developer; hook files with executable permissions set unexpectedly.
• File System: Presence of encoded or obfuscated shell commands (e.g., base64-decoded payloads, curl/wget commands, reverse shell one-liners) within any .git/hooks/ script.
• Process: Unusual child processes spawned by git (e.g., bash, sh, python, curl, wget, nc, ncat) during routine Git operations such as commit, checkout, or pull.
• Network: Unexpected outbound connections from the developer's workstation to unknown external IP addresses or domains, particularly following Git operations.
• Logs: Shell history or process audit logs showing execution of unexpected commands immediately after a git commit, git checkout, or git pull invocation.
• Logs: Cursor or AI agent logs showing instructions to write files into .git/ directories, especially hook scripts, that were not explicitly requested by the user (GitHub Advisory, Novee Security).

The primary remediation is to upgrade Cursor to version 2.5 or later, which fixes the missing authorization controls over .git configuration and hook files (GitHub Advisory). Organizations and individual developers running Cursor prior to 2.5 should prioritize this update immediately given the high severity and zero-user-interaction exploitation path. As a temporary workaround prior to patching, developers can manually audit and restrict write permissions on .git/hooks/ directories in sensitive repositories, and review existing hook files for unexpected content. Additionally, developers should exercise caution when using Cursor's AI agent with untrusted repositories or files that may contain prompt injection content.

The vulnerability received notable coverage across security media, with CSO Online, The Hacker News, HackRead, GBHackers, and CyberSecurityNews all reporting on the flaw and its implications for AI-assisted development environments (CSO Online, The Hacker News). Security researchers and the community highlighted the broader concern of AI coding agents being weaponized via prompt injection to perform actions outside their intended sandbox, with Reddit and Hacker News threads discussing the supply chain implications (Reddit, Hacker News). Researcher Alex Reed published a blog post on supply chain risks from AI agents, and Novee Security published a detailed technical write-up (Novee Security). SecurityWeek included the vulnerability in its weekly news roundup, and Pixee.ai's weekly briefing flagged it alongside other AI agent security issues (SecurityWeek).