CVE-2026-63093: Cursor IDE 0day Allows Malicious git.exe/hatch.exe Auto-Run with No AI or User Prompt

Mindgard disclosed a high-severity Cursor IDE binary-planting vulnerability CVE-2026-63093 (CVSS 8.7). An attacker only needs to place a malicious git.exe at the repo root, or a pyproject.toml that triggers hatch.exe. Opening the project on Windows auto-executes it—no user prompt, no AI interaction. Cursor disables Workspace Trust by default, expanding the AI IDE attack surface.

CVE-2026-63093 is a high-severity binary-planting vulnerability in the AI coding assistant Cursor IDE. CVSS v3.1: 8.7. An attacker can drop a malicious `git.exe` at the Git repo root, or trigger automatic execution of `hatch.exe` via `pyproject.toml`. When a developer opens the repo on Windows, the malicious binary runs automatically—no user prompt, no user interaction, no AI model involvement. Silent code execution. Cursor silently patched on July 13 but issued no formal security advisory, expanding the default attack surface of AI coding tools.

Incident Overview

Mindgard found CVE-2026-63093 while mapping security boundaries of AI coding tools. Root cause: Cursor IDE does not validate path priority for same-named executables in the repo root when opening a local repository. A binary shipped with the repo runs ahead of the same-named tool on system PATH. Worse: Cursor disables Workspace Trust by default. Opening an ordinary folder can reach a code-execution path. The `pyproject.toml` → `hatch.exe` path is stealthier still—build files are rarely treated as suspicious.

Technical Details

Binary planting: the OS resolves commands by PATH and current-directory priority. Some dev tools spawn subprocesses without handling that rule correctly. An attacker overlays the system default tool with a same-named executable at the repo root.

CVE-2026-63093 has two trigger chains:

• `git.exe` path: Cursor resolves `git.exe` from the repo root first. The planted binary inherits the IDE process privileges and runs silently
• `hatch.exe` path: a build hook declared in `pyproject.toml` launches `hatch.exe`. Same-name overlay hijacks the build. Build files carry implicit execute authority and rarely raise suspicion

Cursor disables Workspace Trust by default, further expanding the attack surface. Workspace Trust is a VS Code-family safety switch. When enabled, the user must explicitly authorize automatic task execution in the current folder. Cursor turns it off for AI automation UX. Result: opening a seemingly ordinary project triggers code execution with no security prompt.

Impact Assessment

CVSS: 8.7 (High). Attack vector: local. Attack complexity: low. Privileges required: low (only need to induce the user to clone or open the repo). User interaction: yes (open the repo), but no security prompt. PoC status: Mindgard published technical analysis and a disclosure timeline. Known in-the-wild: no exploitation of this CVE observed; similar patterns have long existed in the open-source ecosystem. Impact surface: all developers using Cursor IDE on Windows with default config. Combined with AI IDE auto-task workflows, potential victims include enterprise R&D teams and open-source contributors.

Affected Scope and Versions

• Cursor IDE Windows (disclosure/fix window): affected version numbers not explicitly disclosed. Silently patched on 2026-07-13
• Trigger: Windows + Cursor default config + user opens a repo containing malicious `git.exe` or `pyproject.toml`
• macOS / Linux impact not explicitly disclosed

Remediation

• Upgrade Cursor IDE immediately to a build after 2026-07-13. Confirm the patch landed.
• Explicitly enable Workspace Trust in Cursor settings. Require explicit per-workspace authorization before tasks run.
• Maintain a repo-source trust list: clone only from trusted orgs and trusted individuals. Open unknown-origin projects in a read-only environment or a container.
• On endpoint EDR, monitor process chains of key dev tools (`git.exe`, `hatch.exe`). Flag unexpected children spawned from the IDE process.
• Enable Sysmon process-creation monitoring. Capture unconventional path loads of `git.exe` / `hatch.exe` from the repo root.
• Run AI coding tools inside a sandbox. Do not give the IDE direct host privileges.
• Train development teams on AI IDE security. Emphasize Workspace Trust and repo-source verification.

Detection Rules

• Sysmon Event ID 1: alert when Image for `git.exe` or `hatch.exe` is at the repo root rather than a system PATH location
• EDR behavior: IDE process spawns unexpected children (`git.exe`, `hatch.exe`, `curl`, `wget`, `powershell`)
• File monitoring: unexpected `git.exe` or `hatch.exe` appearing at the repo root
• Endpoint EDR: enable PowerShell Script Block Logging and module logging. Capture suspicious scripts fired by malicious build hooks

AI coding tools are reshaping R&D workflows and introducing new attack surface. This Cursor incident shows that AI involvement does not change underlying patterns such as binary planting. Default-off Workspace Trust expands impact. Evaluate default security config when adopting an AI IDE. Combine sandbox, EDR, and process training for defense in depth.

References

• HackersRadar: Critical Azure and Entra ID Flaws
• Cybersecurity Institute: Security Operations Weekly August 23 2026
• Encrygma: AI Cyber Security Intelligence