c/security · by Kissaki@programming.dev · 37d

Cursor 0day: When Full Disclosure Becomes the Only Protection Left - Mindgard

https://mindgard.ai/blog/cursor-0day-when-full-disclosure-becomes-the-only-protection-left

After loading a project, Cursor attempts to find git binaries at various locations including the current workspace. By creating a repository with a planted malicious git.exe in the root, the IDE will execute it with no user interaction and no prompting of the user. This occurs repeatedly on a cadence.

6 points · 1 comments · view on lemmy.world

1 Comments

artwork@lemmy.world · 7 pts · 37d

...Report initially closed as Informative and out of scope...
Report reopened...
...
2026-02-16 - Update requested, no response received
2026-03-03 - Update requested, no response received
...
2023-03-17 - Direct outreach to Cursor CISO requesting update
2026-03-18 - HackerOne indicates Cursor has been contacted
2026-04-01 - Update requested, no response received...

Source

Thankfully, never used, will never use.