artwork comments on Cursor 0day: When Full Disclosure Becomes the Only Protection Left

Cursor 0day: When Full Disclosure Becomes the Only Protection Left - Mindgard (mindgard.ai)

submitted 3 months ago by Kissaki@programming.dev to c/security@programming.dev

1 comment fedilink hide all child comments

After loading a project, Cursor attempts to find git binaries at various locations including the current workspace. By creating a repository with a planted malicious git.exe in the root, the IDE will execute it with no user interaction and no prompting of the user. This occurs repeatedly on a cadence.

you are viewing a single comment's thread
view the rest of the comments

[–] artwork@lemmy.world 7 points 3 months ago* (last edited 3 months ago)

...Report initially closed as Informative and out of scope...
Report reopened...
...
2026-02-16 - Update requested, no response received
2026-03-03 - Update requested, no response received
...
2023-03-17 - Direct outreach to Cursor CISO requesting update
2026-03-18 - HackerOne indicates Cursor has been contacted
2026-04-01 - Update requested, no response received...

Source

Thankfully, never used, will never use.

permalink

fedilink

source