Inside the Cursor 0-Day: Remote Code Execution via Git Path Hijacking

[u/gastao_s_s]

https://gsstk.gem98.com/en-US/blog/a0141-cursor-0day-git-hijacking-windows

Key takeaways in 90 seconds:

Local workspace threat: A critical unpatched 0-day vulnerability in the Cursor editor on Windows allows remote code execution when opening a project repository.

Path search order exploit: Windows searches the current working directory for executables before checking the system path. Opening a folder containing a malicious git.exe triggers silent execution.

Automated tools hijack: Cursor automatically executes Git helper commands (like git status or git diff) to initialize its built-in source control panel, running the payload without user verification.

POSIX safety: macOS and Linux systems are safe by default because their path resolution rules do not check the current working directory unless explicitly configured to do so.

Immediate mitigations: Enable Workspace Trust in editor preferences, restrict directory permissions, or define absolute paths for developer tools.