Vulnerability in Anysphere Cursor
CVE-2026-63093
Cursor for Windows version 3.2.16 contains a binary planting vulnerability that allows remote attackers to achieve arbitrary code execution by placing a malicious git.exe file in the repository root directory. When a developer clones and opens a crafted repository, Cursor automatically resolves and executes the workspace-resident git.exe during IDE startup and on a recurring timed cadence without any user interaction, running the malicious binary under the privileges of the current user.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.008 (57.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 58th percentile — 57.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.008 · change: +0.003
Affected products
- Anysphere Cursor
- Anysphere, Inc. Cursor — versions 3.2.16
- Microsoft Windows
Weakness classification (CWE)
References
- mindgard.ai/blog/cursor-0day-when-full-disclosure-becomes-the-only-protection-l… (Exploit, technical-description, Third Party Advisory, exploit)
- cursor.com/ (Product, product)
- www.vulncheck.com/advisories/cursor-for-windows-rce-via-malicious-git-exe-in-wo… (Exploit, Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2026-63093?
- CVE-2026-63093 is a high-severity vulnerability in Anysphere Cursor, classified under Untrusted Search Path. CVSS score: 8.8/10. Published 2026-07-17.
- How severe is CVE-2026-63093?
- High severity. CVSS v3 base score is 8.8 out of 10.