CVE-2026-63093— Cursor for Windows 3.2.16 RCE via Malicious git.exe in Workspace
Possible ATT&CK Techniques 3AI
T1587.001 · Malware T1059 · Command and Scripting Interpreter T1204.002 · Malicious FileAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Anysphere, Inc. | Cursor | 3.2.16 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-63093
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cursor for Windows 3.2.16 RCE via Malicious git.exe in Workspace
Source: NVD (National Vulnerability Database)
Vulnerability Description
Cursor for Windows version 3.2.16 contains a binary planting vulnerability that allows remote attackers to achieve arbitrary code execution by placing a malicious git.exe file in the repository root directory. When a developer clones and opens a crafted repository, Cursor automatically resolves and executes the workspace-resident git.exe during IDE startup and on a recurring timed cadence without any user interaction, running the malicious binary under the privileges of the current user.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
不可信的搜索路径
Source: NVD (National Vulnerability Database)
Vulnerability Title
Anysphere Cursor 权限许可和访问控制问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
anysphere cursor是美国anysphere公司的一款AI代码编辑器。 Anysphere Cursor 3.2.16版本存在权限许可和访问控制问题漏洞，该漏洞源于存在二进制种植漏洞，通过在仓库根目录放置恶意git.exe文件，当开发者克隆并打开精心构造的仓库时，Cursor在IDE启动时自动解析并执行工作区中的git.exe，无需用户交互即可在当前用户权限下运行恶意二进制文件，可能导致远程攻击者实现任意代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Anysphere, Inc. | Cursor | 3.2.16 | - |
II. Public POCs for CVE-2026-63093
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-63093
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-63093 (1)
Security Blog Posts for CVE-2026-63093 (1)
- 🔗 Cursor 0day: When Full Disclosure Becomes the Only Protection Left - Mindgard Read full article technical-descriptionexploit
Vendor Pages for CVE-2026-63093 (1)
- 🔗 Cursor: AI coding agentproduct
IV. Related Vulnerabilities
Same product: Cursor
- CVE-2026-61613
Cursor: Cloud Agent Browser Sandbox Escape - CVE-2026-50548
Cursor Desktop sandbox escape via agent-controlled working d - CVE-2026-50549
Cursor Desktop sandbox escape via symlink and failed path ca - CVE-2026-48124
Cursor Desktop sandbox escape via Claude hook configuration - CVE-2026-31854
Cursor Affected by Arbitrary Code Execution via Prompt Inje
Same weakness: CWE-426
V. Comments for CVE-2026-63093
No comments yet