Sandbox Escape Vulnerability in Cursor Code Editor by Cursor

CVE-2026-26268

What is CVE-2026-26268?

The Cursor code editor, designed for AI programming, is vulnerable to a sandbox escape due to improper handling of .git configuration files in versions prior to 2.5. This vulnerability allows a malicious agent to manipulate .git settings, including git hooks, potentially leading to remote code execution when the compromised commands are triggered. The attack does not require user interaction, as Git executes these commands automatically. Users are advised to update to version 2.5 or later to mitigate this risk. For more information, refer to the advisory at GitHub.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References