1.7K
Hey there, tech enthusiasts! Have you heard about the latest security vulnerability shaking up the AI coding world? A sneaky bug in Cursor’s git.exe could potentially hijack any Windows machine it comes across. Despite being reported seven months ago, there’s still no fix in sight. Mindgard, a leading AI security firm, recently shared all the technical details on this alarming issue on July 14, 2026.
So, what’s the deal with this vulnerability? Well, it all boils down to how Cursor handles the Git binary when opening a project on Windows. The flaw lies in how Cursor resolves the location of `git.exe`, with one of the search locations being the root of the workspace itself. This means that dropping a file named `git.exe` into a project’s top-level folder could lead to the execution of malicious code without any warning or user interaction.
Diving Deeper into the Cursor git.exe vulnerability
Mindgard demonstrated the severity of the issue with a simple yet effective demo. By renaming the Windows Calculator app to `git.exe` and placing it in a test repository’s root folder, they were able to showcase how Cursor repeatedly launched the fake binary without hesitation. This flaw opens the door for attackers to execute malicious code under the developer’s account, potentially compromising sensitive data like source code and SSH keys.
But here’s the kicker – this vulnerability is not just limited to Cursor. Similar patterns were found in other popular AI coding assistants like GitHub Copilot CLI, Google’s Gemini CLI, and OpenAI’s Codex app. It seems like a widespread issue that demands immediate attention from the tech community.
The Waiting Game: Seven Months and Counting
Despite being reported to Cursor’s security team back in December 2025, the response has been less than satisfactory. Mindgard’s attempts to follow up on the issue were met with silence, prompting them to take the drastic step of going public with the information on July 14, 2026. It’s a classic case of a critical security flaw falling through the cracks, with no patch in sight.
As we navigate through this sea of vulnerabilities, it’s crucial for developers and organizations to exercise caution when dealing with external repositories. Until a fix is released, consider opening unfamiliar clones in a secure environment or implementing stricter control measures to mitigate the risk posed by the Cursor git.exe vulnerability.
