A planted git.exe in a repository root executes automatically when a developer opens that project in Cursor on Windows — no click, no prompt, no warning. Mindgard disclosed the vulnerability publicly, framing full disclosure as the only remaining protection for users.
The attack chain:
- Vector: Cursor searches for git binaries in multiple locations, including the current workspace directory
- Trigger: Opening a project is the only action needed — the IDE runs the planted
git.exewith zero user interaction - Platform: Windows-specific, exploiting automatic
.exeexecution from the workspace - Payload: Arbitrary code execution with the developer’s own permissions
This hits the exact workflow that made Cursor popular. Developers clone repos, open them in Cursor, and start prompting. A malicious actor plants a git.exe in a public repo — or a compromised dependency drops one into a private repo — and the developer’s machine is compromised before they type a single prompt.
The HN thread (272 points, 125 comments) split between researchers frustrated at slow vendor response and developers asking why an IDE would execute workspace binaries without consent. Mindgard’s decision to publish full details puts pressure on Anysphere to ship a patch, but it also puts working exploit instructions in the wild.
WARNING
If you use Cursor on Windows, do not open untrusted repositories until a patch is confirmed. A git.exe in any project root will execute silently on load. Audit workspace directories for unexpected .exe files before opening.
No patch has been confirmed at time of writing. The safest immediate mitigation is to scan any repo for a root-level git.exe before opening it in Cursor, and verify your system PATH resolves git before any workspace directory.