Cursor 0day: When Full Disclosure Becomes the Only Protection Left

Original Article ↗ Hacker News Discussion ↗

A security report claims that the Cursor AI code editor on Windows will automatically execute a `git.exe` binary found in the root of any opened repository, effectively granting remote code execution to anyone who can get such a file into a project the user clones. Commenters debate how severe this is, contrasting it with long-known Windows behavior that searches the current directory before `PATH`, similar auto-execution patterns in other IDEs and build tools, and the broader risk of treating cloned repositories as implicitly safe. Many are more alarmed by Cursor’s apparent lack of response to months of coordinated disclosure attempts and by the fact that it ships VS Code’s workspace trust protections disabled by default.

Nature of the vulnerability & platform specifics

  • Cursor on Windows tries to locate git and will run git.exe found in the current workspace root, which allows a repository to plant a malicious git.exe that runs when the project is opened.
  • Several comments note this relies on a long‑standing Windows behavior: the current directory is searched for executables before PATH. PowerShell doesn’t do this by default; cmd.exe does.
  • Some argue this is therefore a Windows quirk that many tools are theoretically exposed to; others counter that secure software should work around known OS pitfalls.

How serious is this?

  • One camp sees it as a major RCE risk: simply cloning and opening a repo in an IDE should not execute arbitrary binaries, and people commonly pull untrusted code for review.
  • Another camp downplays it: if an attacker can place a malicious binary in your repo, you’re already compromised; they compare it to malicious .bashrc or npm install scripts.
  • Disagreement centers on whether “cloned code on disk” equals “already compromised,” or whether automatic execution is a qualitatively different step.

Comparisons & analogies

  • Compared to: Windows AutoPlay/autorun, old DLL‑preloading tricks, and Unix’s historic decision to exclude . from PATH.
  • Some note that other IDEs already auto‑run build tools or tasks, but typically behind a “trust this workspace” prompt.

Cursor design choices

  • Cursor is based on VS Code but reportedly ships with Workspace Trust disabled, so protective prompts are absent by default.
  • Commenters question why Cursor ever needs to execute a git.exe from the project root instead of a known global binary or a configured path.
  • Several argue agents and AI‑assisted tooling should always run in sandboxes precisely because of patterns like this.

Disclosure process & AI “slop”

  • Many are troubled that the report was initially downgraded, then acknowledged, and still not fixed after months and many releases.
  • Some suggest vulnerability programs are overwhelmed by LLM‑generated, low‑quality reports, making triage harder and possibly causing real issues to be missed.
  • Others argue that if a company sells AI tooling, it should itself use robust automated triage and treat this as a clear, fixable bug, not background noise.