Cursor IDE Binary Planting Flaw Enables Zero-Click Code Execution A critical binary planting vulnerability in the Cursor IDE (CVE-2026-63093, CVSS 8.7) allows attackers to execute arbitrary code when a developer opens a malicious repository on Windows. The flaw, disclosed by Mindgard on July 14, 2026, stems from Cursor’s method of locating the `git.exe` binary during project loading. When opening a repository, Cursor searches for `git.exe` in multiple locations, including the workspace root. If a malicious file named `git.exe` is planted there and no legitimate binary exists in trusted system paths Windows executes the attacker’s file automatically under the logged-in user’s privileges. The attack requires no user interaction, prompts, or prior access to the victim’s machine. Mindgard demonstrated the flaw by replacing `git.exe` with a renamed Windows Calculator app, which launched immediately upon opening the repository. The issue extends beyond `git.exe`: Cursor also searches for `hatch.exe` when a `pyproject.toml` file is present, using the same insecure resolution logic. Unlike more conspicuous execution methods (e.g., `tasks.json`), `pyproject.toml` files appear benign, making this a stealthier attack vector. Workspace Trust, a security feature meant to block execution in untrusted folders, proved ineffective. Testing on Trae IDE (which enables Workspace Trust by default) showed the IDE still attempts to locate `git.exe` in untrusted workspaces. Cursor ships with Workspace Trust disabled by default, meaning code execution can occur without any user confirmation when opening a folder. The vulnerability was reported to Cursor on December 15, 2025, but the company initially dismissed it as out of scope for its bug bounty program, citing a shared-responsibility model. Cursor later addressed the issue on July 13, 2026, just before Mindgard’s public disclosure though no formal security advisory was issued. The flaw is part of a broader attack surface in AI-powered IDEs, including unpatched Chromium vulnerabilities in outdated Electron builds affecting Cursor and Windsurf, impacting an estimated 1.8 million developers. Other recent Cursor vulnerabilities, such as CVE-2026-50548 and CVE-2026-50549 (DuneSlide), enabled sandbox escape and OS-level remote code execution via prompt injection, patched in Cursor 3.0. The incident highlights risks in binary resolution logic and the assumption that only specific filenames (e.g., `git.exe`) pose threats. Attackers can exploit any executable file in a workspace if it aligns with the IDE’s search behavior.