CVE-2026-63093 – Cursor

CVSS 8.8 IMPORTANT Zero Day – Immediate Deployment

“A trusted development tool can become the attacker's launcher when it executes the wrong binary.”

Cursor for Windows version 3.2.16 addresses a binary planting vulnerability that could allow arbitrary code execution in the context of the current user. The flaw allows a remote attacker to place a malicious git.exe file in a repository root. When a developer clones and opens the crafted repository, Cursor automatically resolves and executes the workspace-resident binary during IDE startup and on a recurring schedule without requiring additional user interaction. The vulnerability is associated with CWE-426 (Untrusted Search Path).

The CVSS score is 8.8, which is High severity. Based on the information provided, a public proof-of-concept (PoC) is available for this vulnerability.

Key Details

Affected Product
Anysphere Cursor
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
CWE Classification
CWE-426
Patch this CVE on all your endpoints in under 5 minutes. First 200 endpoints are free forever, scale as needed.