CVE-2026-63093: 
NixOS vulnerability analysis and mitigation

CVE-2026-63093 is a binary planting (untrusted search path) vulnerability in Cursor for Windows version 3.2.16, developed by Anysphere, Inc. It allows remote attackers to achieve arbitrary code execution by placing a malicious git.exe file in the root directory of a crafted repository. When a developer clones and opens the repository, Cursor automatically resolves and executes the workspace-resident git.exe during IDE startup and on a recurring timed cadence — without any additional user interaction — running the malicious binary under the current user's privileges. The vulnerability was published on July 17, 2026, and carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, VulnCheck).

The root cause is classified as CWE-426 (Untrusted Search Path): Cursor for Windows resolves the git.exe binary by searching the workspace/repository directory before consulting system-level PATH entries, allowing a repository-resident executable to take precedence over the legitimate system Git installation. An attacker crafts a repository containing a malicious git.exe in its root directory and hosts it on a public or targeted platform; when the victim clones and opens the repository in Cursor, the IDE automatically invokes the attacker-controlled binary both at startup and periodically thereafter. No privileges are required on the attacker's side, and the only precondition is that the victim opens the malicious repository in Cursor 3.2.16 on Windows. This technique maps to MITRE ATT&CK T1574.007 (Path Interception by PATH Environment Variable) and CAPEC-38 (Leveraging/Manipulating Configuration File Search Paths) (GitHub Advisory, Mindgard Blog).

Successful exploitation grants the attacker arbitrary code execution on the developer's machine with the full privileges of the logged-in user, resulting in high confidentiality, integrity, and availability impact. An attacker can exfiltrate source code, credentials, API keys, and other sensitive developer assets; install persistent malware or backdoors; and use the compromised developer workstation as a pivot point for lateral movement into internal networks or CI/CD pipelines. Because execution recurs on a timed cadence after initial compromise, persistence is maintained without further attacker interaction (GitHub Advisory, VulnCheck).

The NVD SSVC assessment classifies exploitation status as "poc" (proof-of-concept exists), though no public PoC code has been independently confirmed at the time of publication. There is no evidence of in-the-wild exploitation or threat actor attribution as of the disclosure date. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, though CVE-2026-63093 was referenced in a CISA vulnerability bulletin (SB26-201). The EPSS score is approximately 0.43%, placing it in the 37th percentile for exploitation probability within 30 days (GitHub Advisory, VulnCheck).

1. Craft a malicious repository: Create a Git repository and place a malicious Windows executable named git.exe in the repository root directory. This binary can contain any payload (e.g., reverse shell, credential harvester, dropper).
2. Host the repository: Publish the crafted repository to a public hosting platform (e.g., GitHub, GitLab, Bitbucket) or a targeted internal server accessible to the intended victim.
3. Lure the victim: Social-engineer the target developer into cloning the repository — for example, via a phishing email, a fake open-source project, a dependency confusion attack, or a malicious pull request invitation.
4. Victim opens the repository in Cursor: When the developer opens the cloned repository folder in Cursor for Windows 3.2.16, the IDE initializes and searches for git.exe starting from the workspace root directory.
5. Automatic execution of malicious binary: Cursor resolves and executes the attacker-controlled git.exe from the repository root instead of the legitimate system Git binary, running the payload under the developer's user privileges — with no further user interaction required.
6. Persistence via timed cadence: Cursor continues to invoke git.exe on a recurring schedule during the IDE session, ensuring the payload re-executes periodically even if the initial execution is interrupted (Mindgard Blog, VulnCheck).

• File System: Presence of a git.exe file in the root directory of a cloned repository (outside of standard Git installation paths such as C:\Program Files\Git\bin\); unexpected executables in workspace directories opened by Cursor.
• Process: git.exe processes spawned with a working directory or image path pointing to a repository folder rather than the system Git installation directory; child processes of Cursor (e.g., cursor.exe) launching git.exe from non-standard paths; unusual network connections or child processes (e.g., cmd.exe, powershell.exe, curl.exe) spawned by a workspace-resident git.exe.
• Network: Unexpected outbound connections from developer workstations to unknown external IPs or domains shortly after opening a repository in Cursor; beaconing behavior consistent with a recurring timed execution pattern.
• Logs: Windows Event Logs (Security/Application) showing process creation events for git.exe with image paths outside standard Git installation directories; Cursor application logs referencing git binary resolution from workspace paths.

Users should update Cursor for Windows to a version newer than 3.2.16 as soon as a patched release is available from Anysphere, Inc. Until a patch is applied, developers should avoid cloning and opening repositories from untrusted or unknown sources in Cursor, and should manually inspect repository contents for unexpected executables (particularly git.exe) before opening them. As an additional control, administrators can configure Windows application whitelisting policies (e.g., via AppLocker or Windows Defender Application Control) to prevent execution of git.exe from non-standard paths such as repository directories (GitHub Advisory, Mindgard Blog).

The vulnerability was disclosed publicly by Mindgard AI via a full-disclosure blog post, with the title "Cursor 0day: When Full Disclosure Becomes the Only Protection Left" — suggesting the researcher opted for full disclosure after other remediation avenues were exhausted (Mindgard Blog). VulnCheck published an advisory documenting the issue and assigned it a formal advisory identifier (VulnCheck). The vulnerability was covered by TechRepublic and referenced in a CISA vulnerability bulletin (SB26-201), indicating moderate industry attention given the popularity of Cursor among AI-assisted development workflows (CISA Bulletin, TechRepublic).