CVE-2026-63093CWE-426

CVE-2026-63093

High · published July 17, 2026

CVSS v3.1

8.8

EPSS

Percentile

57.7

In the wild

Unconfirmed

What it is

Cursor for Windows version 3.2.16 contains a binary planting vulnerability that allows remote attackers to achieve arbitrary code execution by placing a malicious git.exe file in the repository root directory. When a developer clones and opens a crafted repository, Cursor automatically resolves and executes the workspace-resident git.exe during IDE startup and on a recurring timed cadence without any user interaction, running the malicious binary under the privileges of the current user.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00847 · 57.7th percentile
Weakness: CWE-426 · Untrusted Search Path
Published: 2026-07-17T19:16Z

Affected products (1)

Product	Versions	Fixed in
anysphere/cursor	≤ 3.2.16	—

References (3)

https://cursor.com/ · [email protected]https://mindgard.ai/blog/cursor-0day-when-full-disclosure-becomes-the-only-protection-left · [email protected]https://www.vulncheck.com/advisories/cursor-for-windows-rce-via-malicious-git-exe-in-workspace · [email protected]

EPSS history

Timeline

17 JUL 14:23Z
Cursor for Windows 3.2.16 RCE via Malicious git.exe in Workspace
cvelistv5