\n<\/p>\n
An unpatched vulnerability in Cursor on Home windows may be triggered for code execution when a developer opens a repository within the software, Mindgard studies.<\/strong><\/p>\n Cursor is without doubt one of the hottest AI-assisted growth environments, with greater than 7 million lively customers.<\/p>\n The safety defect, Mindgard says, is easy: when opening a repository, Cursor would robotically execute a malicious git.exe binary within the mission\u2019s root with out warning the consumer or asking for approval.<\/p>\n \u201cThe vulnerability shouldn’t be theoretical and doesn’t rely on a fancy chain of exploitation, immediate injection, mannequin manipulation, jailbreaks, reminiscence corruption, or subtle attacker tradecraft. Exploitation merely requires a developer to open a mission containing a git.exe binary within the repository on the root,\u201d Mindgard says.<\/p>\n In response to Mindgard, the problem exists as a result of, when loading a mission, Cursor appears to be like for Git binaries in a number of places, together with the workspace itself.<\/p>\n \u201cIf an attacker planted a malicious git.exe within the repository root, Cursor will execute it robotically as a part of its path decision logic with out warning, approval, and even a sign that executable content material from the repository is about to run,\u201d Mindgard explains.<\/p>\n