Story
Cursor 0day: When Full Disclosure Becomes the Only Protection Left
1 report
1 website
1 discussion
Latest report
Overview
Cursor IDE executes malicious git.exe files from the root of a project repository without user interaction or prompts. This vulnerability allows repeated execution of the planted malicious file, posing a significant security risk.
Summary from mindgard.ai.
Reports
One report so far. Additional coverage will appear here when it is linked to this story.
Community reactions
Each reaction summarizes sampled comments from the linked discussion.
Hacker News · mindgard.ai
Hacker News discussion ↗
Historical count: 5 · 5 saved in sample · Historical sample
Analysis ready
Read this discussion’s reaction
Based on 5 sampled comments from this thread. Analyzed 2026-07-15.
- Praise: The AI-assisted workflow is ambitious, aiming to streamline tasks like summarizing a repo and enhancing user productivity — but it raises valid concerns about security.
- Praise: Some commenters appreciate the idea behind Cursor trying to automate git commands to enrich the user experience, even if the implementation is flawed.
- Concern: The lack of response from Cursor to reported vulnerabilities is alarming, suggesting a neglect of user safety and security that can't be ignored.
- Concern: This exploit highlights a significant design flaw in Cursor, where it executes arbitrary code without proper user prompts — a glaring oversight in security practices.
- Concern: Many users express skepticism over the decision to run executables without clear permissions, indicating a serious risk in trusting such tools with sensitive workflows.