CVE-2026-63093Patch(anysphere / cursor)

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch anysphere cursor systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Cursor for Windows version 3.2.16 contains a binary planting vulnerability that allows remote attackers to achieve arbitrary code execution by placing a malicious git.exe file in the repository root directory. When a developer clones and opens a crafted repository, Cursor automatically resolves and executes the workspace-resident git.exe during IDE startup and on a recurring timed cadence without any user interaction, running the malicious binary under the privileges of the current user.

anysphere CVEs Back to dashboard

1.0/ 10 priority

Sources & remediation

Exploit / PoC references

Other references

https://cursor.com/

Weakness type (CWE)

CWE-426

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

cursor
windows

Threat summary

Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 4 signals
Disclosure: 2 classified signals
Peaked 1d ago at 2 mentions (2026-08-19); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

anysphere microsoft

Products

cursorwindows

1 version affected across 2 products

Deep dive

Activity timeline4 mentions / 3d

Signal classification2 categories

Patch

250.0%

Disclosure

250.0%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-28	1	Patch1
2026-08-19	2	Disclosure2
2026-08-27	1	Patch1

Full discourse4 posts

ThreatWire@ThreatWire_70d
Disclosure
🚨 CRITICAL: A Cursor IDE vulnerability allows arbitrary code execution on Windows simply by opening a malicious repository. Tracked as CVE-2026-63093, the binary planting flaw lets an attacker place a malicious git.exe in the repository root. Cursor can then automatically execute it with the user’s privileges — no prompt injection, AI agent, or additional interaction required. Mindgard disclosed the issue after reporting it to Cursor in December 2025. #Cursor #CVE #RCE #CyberSecurity #DevSecOps #Infosec
Post summary
The post announces CVE-2026-63093, a Cursor IDE vulnerability that allows arbitrary code execution via binary planting, detailing how a malicious git.exe can be executed automatically without user interaction.
00020656
1.7K followersView on X
iototsecnews@iototsecnews62d
Patch
Cursor IDE の脆弱性 CVE-2026-63093 が FIX：信頼できないリポジトリを介したコード実行の可能性 https://iototsecnews.jp/2026/08/19/cursor-0-day-lets-attackers-execute-malicious-code-by-opening-a-repository/ この問題の背景にあるのは、Cursor IDE における外部プログラムの検索処理の欠落です。この脆弱性 CVE-2026-63093 により、外部フォルダの読み込みを通じた不正プログラムの自動呼び出し／開発者権限での任意コード実行／端末の不当な制御といった重大な被害が生じる恐れがあります。対応策として、修正適用済みバージョンへの更新／不審なパスからのプロセス生成監視／作業フォルダ内の未確認バイナリの事前点検が推奨されます。 #Cursor #CVE202663093 #Vulnerability
Post summary
The post discloses CVE-2026-63093 in Cursor IDE, describes a code‑execution flaw via untrusted repositories, and emphasizes updating to patched versions plus monitoring as mitigation.
0001094
510 followersView on X
CyberSignal | Cybersecurity News@XQOPTRX70d
Disclosure
CyberSignal Daily ✓ · 👨‍💻 Developer Security · August 19, 2026 🎯 For developers, even opening a repository can become part of the attack surface. A vulnerability tracked as CVE-2026-63093 affected the Windows version of the AI-powered Cursor IDE and involved unsafe executable-resolution behavior. Researchers found that attacker-controlled executable files placed inside a repository could potentially be launched when Cursor interacted with the project, resulting in code execution with the privileges of the user who opened it. The issue was originally reported to Cursor in December 2025, and the known executable-discovery vulnerabilities have reportedly been addressed in later releases. This is an excellent CyberSignal story because it combines AI coding tools + software supply-chain security + developer workstations. 🔗 Source: GBHackers / Mindgard research #Cursor #AI #DevSecOps #CVE #SupplyChain #DeveloperSecurity #CyberSecurity
Post summary
A newly disclosed CVE-2026‑63093 affecting Cursor IDE allows potential code execution via auto‑discovery of executables, and the vendor has addressed the issue in subsequent releases.
0000055
82 followersView on X
CompuChris@compuchris91d
Patch
Cursor Quietly Patches High-Severity Git Vulnerability After Seven-Month Delay https://www.techrepublic.com/article/news-cursor-git-code-execution-vulnerability-cve-2026-63093/
Post summary
Cursor has quietly released a patch for the high‑severity CVE‑2026‑63093 git code‑execution vulnerability after a seven‑month delay.
0000024
1.7K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	anysphere	cursor	-	-	-
OS	microsoft	windows	-	-	-

Explore more

Back to dashboard anysphere CVEs microsoft CVEs cursor vulnerabilities

What researchers are saying

CVE-2026-63093

ThreatWire[verified]@ThreatWire_Disclosure

The post announces CVE-2026-63093, a Cursor IDE vulnerability that allows arbitrary code execution via binary planting, detailing how a malicious git.exe can be executed automatically without user interaction.

CyberSignal | Cybersecurity News[verified]@XQOPTRXDisclosure

A newly disclosed CVE-2026‑63093 affecting Cursor IDE allows potential code execution via auto‑discovery of executables, and the vendor has addressed the issue in subsequent releases.

CompuChris[verified]@compuchrisPatch

Cursor has quietly released a patch for the high‑severity CVE‑2026‑63093 git code‑execution vulnerability after a seven‑month delay.

iototsecnews@iototsecnewsPatch

The post discloses CVE-2026-63093 in Cursor IDE, describes a code‑execution flaw via untrusted repositories, and emphasizes updating to patched versions plus monitoring as mitigation.