CVE-2026-63093 – Cursor
“A trusted development tool can become the attacker's launcher when it executes the wrong binary.”
Cursor for Windows version 3.2.16 addresses a binary planting vulnerability that could allow arbitrary code execution in the context of the current user. The flaw allows a remote attacker to place a malicious git.exe file in a repository root. When a developer clones and opens the crafted repository, Cursor automatically resolves and executes the workspace-resident binary during IDE startup and on a recurring schedule without requiring additional user interaction. The vulnerability is associated with CWE-426 (Untrusted Search Path).
The CVSS score is 8.8, which is High severity. Based on the information provided, a public proof-of-concept (PoC) is available for this vulnerability.
Key Details
- Affected Product
- Anysphere Cursor
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- Required
- CWE Classification
- CWE-426