Remote code execution vulnerability in Cursor for Windows
CVE-2026-63093

8.7HIGH

Key Information:

Vendor

Anysphere, Inc.

Status
Cursor
Vendor
CVE Published:
17 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-63093?

Cursor for Windows version 3.2.16 is susceptible to a binary planting vulnerability that endangers user systems by enabling remote attackers to execute arbitrary code. This occurs when a malicious git.exe file is placed in the repository root directory. When developers clone and open such a crafted repository, Cursor automatically detects and executes the git.exe file without any user interaction. This execution happens during the Integrated Development Environment (IDE) startup and continues on a recurring timed schedule, operating under the current user's privileges. This poses significant risks as it can lead to unauthorized access and control over the affected systems.

Affected Version(s)

Cursor Windows 3.2.16

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-63093 - Proof of Concept

References

https://mindgard.ai/blog/cursor-0day-when-full-disclosure...
technical-descriptionexploit
https://cursor.com/
product
https://www.vulncheck.com/advisories/cursor-for-windows-r...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mindgard
.