Cursor AI IDE Vulnerability Enables Code Execution via Git Hooks

A high-severity vulnerability was disclosed in the AI-powered development environment Cursor, exposing developers to arbitrary code execution through malicious Git repositories. The flaw, tracked as CVE-2026-26268 with a severity score of 8.1, demonstrates how modern AI-assisted development tools can introduce new attack surfaces when combined with traditional software mechanisms such as version control systems.

The vulnerability allows attackers to execute code on a developer’s machine simply by convincing them to clone a specially crafted repository. This significantly lowers the barrier for exploitation, as cloning repositories is a routine and trusted operation in software development workflows. Once the repository is cloned, hidden malicious logic embedded within Git configurations can be triggered automatically without requiring additional user interaction.

At the core of the issue is the interaction between Cursor’s AI agent and Git’s built-in features, particularly Git hooks. Git hooks are scripts that execute automatically during specific events such as commits or checkouts. Attackers can abuse this functionality by embedding malicious hooks inside a repository. When the Cursor AI agent performs routine operations, such as checking out code in response to a high-level prompt, these hooks are triggered and execute attacker-controlled commands on the system.

The vulnerability is further amplified by the presence of AI-driven automation within the IDE. Cursor’s agent is capable of executing Git operations autonomously, which introduces a new trust boundary issue. Through techniques such as prompt injection, attackers can manipulate the AI agent into modifying protected Git configuration files, including those responsible for executing hooks. This effectively enables a sandbox escape, allowing malicious actions to occur outside the intended execution environment.

From a technical standpoint, the attack chain does not rely on exploiting a traditional software bug in isolation. Instead, it leverages the combination of legitimate features and AI automation to create an exploitable pathway. By embedding a malicious bare repository within a project and planting harmful scripts, attackers can ensure that routine development actions trigger code execution. This approach highlights a broader issue in AI-assisted development tools, where legacy features were not designed to handle autonomous decision-making by AI agents.

The impact of this vulnerability is significant, particularly in enterprise environments where developers handle sensitive codebases and credentials. Confidentiality is at risk due to potential data exfiltration, integrity is compromised through unauthorized code execution, and availability may be affected if systems are disrupted or further malware is deployed. Additionally, the attack could serve as an entry point for deeper compromise, including persistent access or lateral movement within development environments.

Although there is no confirmed evidence of widespread exploitation in the wild, the nature of the vulnerability makes it highly attractive to threat actors. Development environments are high-value targets, and compromising a developer’s machine can provide access to source code repositories, API keys, and internal systems. The fact that exploitation can occur through normal developer behavior increases the likelihood of successful attacks.

The issue has been addressed in Cursor version 2.5, which introduces protections against unauthorized modifications of Git configuration files and mitigates the risk of sandbox escape. Organizations and individual developers are strongly advised to update to the latest version and exercise caution when cloning repositories from untrusted sources. Additional defensive measures include restricting execution of Git hooks, monitoring for unusual repository structures, and implementing security controls around AI agent behavior.

In conclusion, the Cursor AI IDE vulnerability highlights a critical shift in cybersecurity risks associated with AI-assisted development tools. By combining prompt injection techniques with existing software features, attackers can achieve code execution in ways that bypass traditional security assumptions. This incident underscores the need for secure-by-design principles in AI-integrated development environments and reinforces the importance of treating all external code sources as potential attack vectors.