Cursor for Windows Binary Planting Arbitrary Code Execution

Executive Summary

Cursor for Windows version 3.2.16 has a binary planting vulnerability where attackers can place a malicious git.exe file in a repository root directory. When a developer clones and opens the repository, Cursor automatically executes this malicious file during IDE startup and at regular intervals without any user interaction, running it with the current user's privileges.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unexpected git.exe processes running from workspace directories. Check Cursor's logs for automatic git.exe execution during IDE startup or recurring intervals. Use Windows Event Viewer to review process creation events involving git.exe in untrusted repository paths.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary code on your system with your current user privileges. It can lead to unauthorized access, data theft, malware installation, or further compromise of your development environment without your knowledge or consent.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized code execution on developer systems, potentially exposing sensitive data regulated by GDPR or HIPAA. Attackers may gain access to personal or health information if the compromised system processes such data. Compliance may be impacted if the vulnerability results in data breaches or unauthorized access to regulated environments.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately block execution of git.exe from workspace directories using AppLocker or Windows App Control policies. Avoid opening untrusted repositories in Cursor; use isolated environments like a virtual machine or Windows Sandbox. Monitor system activity for suspicious git.exe processes.

Useful 0 Not Useful 0