{"schema_version":"0.10.0","id":"LR-2026-0649","record_version":1,"title":"Cursor git.exe repo-poisoning zero-day patched without advisory or CVE","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":47.6,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":4.16,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: Tech Times · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: Tech Times · subject to change"}]},"sources_hash":"653b00749b3d2a0b1ee06925e1f047c17452a57468963db19bdce3a714bb93b3"},"system":{"model_name":null,"model_version":null,"developer":"Cursor","harness":null,"tools_granted":[],"permissions_scope":"full privileges of the logged-in developer","autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-07-17","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"public_researcher","summary":"Cursor, an AI coding IDE on Windows, ran a file named git.exe planted at the root of a cloned repository. When Cursor loads a project it issues a Git introspection call and searches the workspace for a Git binary, so the planted file ran with the developer's full privileges and no prompt. Mindgard discovered the flaw on December 15, 2025 and reported it to Cursor; the report drew no confirmation and was later closed as out of scope before HackerOne reopened it. Mindgard demonstrated the flaw with a renamed Calculator binary. Cursor quietly fixed the flaw on July 13, 2026, and as of July 17 it had issued no advisory or CVE. Mindgard published its full technical disclosure on July 14, 2026, 213 days after the initial report.","tags":[],"date_detected":"2025-12-15","near_miss":null,"root_cause":"integration","root_cause_detail":null,"failure_class_detail":null,"responsible_party":"provider","adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Test: many third parties (a stated count of two or more affected parties). Fact: the source states the flaw affects 7 million users.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.techtimes.com/articles/320797/20260717/cursor-patched-silent-repo-poisoning-zero-day-no-advisory-no-cve.htm","publisher":"Tech Times","date":"2026-07-17","type":"press","title":"Cursor Patched a Silent Repo-Poisoning Zero-Day With No Advisory and No CVE - Tech Times","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.developer":"C","system.permissions_scope":"C","event.date_detected":"C","event.detection_method":"C","event.root_cause":"C","event.responsible_party":"C","event.adversarial_actor":"C","event.incident_class":"D","impact.severity":"D","impact.severity_because":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"Cursor quietly fixed this on July 13, 2026, one day before AI security firm Mindgard published its full technical writeup after a seven-month disclosure process that produced silence, a broken bug bounty automation, an initial rejection, and no status updates."}],"system.permissions_scope":[{"source_index":0,"quote":"If the repository contains a file named git.exe at its root, the AI IDE runs it immediately — no click, no approval dialog, no warning — with the full privileges of the logged-in developer."}],"event.date_detected":[{"source_index":0,"quote":"Mindgard discovered the flaw on December 15, 2025, and reported it the same day to Cursor's published security email address."}],"event.detection_method":[{"source_index":0,"quote":"Mindgard discovered the flaw on December 15, 2025, and reported it the same day to Cursor's published security email address."}],"event.root_cause":[{"source_index":0,"quote":"The mechanism is CWE-426 — an untrusted search path — applied to a behavior specific to AI IDEs."}],"event.responsible_party":[{"source_index":0,"quote":"Cursor quietly fixed this on July 13, 2026, one day before AI security firm Mindgard published its full technical writeup after a seven-month disclosure process that produced silence, a broken bug bounty automation, an initial rejection, and no status updates."}],"event.adversarial_actor":[{"source_index":0,"quote":"An attacker who plants a file named git.exe at a repository root exploits exactly this behavior."}],"event.incident_class":[{"source_index":0,"quote":"Clone a stranger's repository and open it in Cursor on Windows."}],"impact.severity":[{"source_index":0,"quote":"It points to a triage culture that treated a reproducible, arbitrary code execution vulnerability affecting 7 million users as a lower priority than feature development, and a disclosure process that required full public disclosure to produce a silent patch without user communication."}],"impact.severity_because":[{"source_index":0,"quote":"It points to a triage culture that treated a reproducible, arbitrary code execution vulnerability affecting 7 million users as a lower priority than feature development, and a disclosure process that required full public disclosure to produce a silent patch without user communication."}],"event.summary":[{"source_index":0,"quote":"If the repository contains a file named git.exe at its root, the AI IDE runs it immediately — no click, no approval dialog, no warning — with the full privileges of the logged-in developer."},{"source_index":0,"quote":"When Cursor loads a project on Windows, it issues a standard Git introspection call, git rev-parse --show-toplevel, to locate the repository root and orient itself within the project structure."},{"source_index":0,"quote":"Mindgard discovered the flaw on December 15, 2025, and reported it the same day to Cursor's published security email address."},{"source_index":0,"quote":"Within days, evaluators closed it as informative and out of scope."},{"source_index":0,"quote":"Mindgard demonstrated the flaw with the Windows Calculator application, renamed git.exe and committed to a repository root."},{"source_index":0,"quote":"As of July 17, the company has issued no public security advisory, assigned no CVE, and told no one which version number contains the fix, according to reporting by Dark Reading and The Hacker News."},{"source_index":0,"quote":"The full technical disclosure landed July 14 — 213 days after the initial report, and 197 or more new Cursor releases after the flaw was first described to the company."}]},"notes_on_gaps":"Single source (Tech Times, press). No date of occurrence is stated, so event.date_occurred is omitted. The flaw is an IDE binary-planting issue in which Cursor itself runs git; the source does not describe an autonomous agent acting, so event.agent_involved, event.failure_class and event.trigger are omitted. No model, model version, harness, lifecycle stage, deployment context, country or industry is stated. The number of affected parties is not stated beyond the 7 million user base quoted; severity major is my judgement under the stated-count test. No actual exploitation or harm is reported, so impact.harm_class and impact.direct_loss_usd are omitted. Patched version number is not stated. Controls I5 and J1 are inferred from the stated failures; E1 is inferred from the advice to use a sandbox. The DeepJack and other Adversa AI and Cymulate findings are separate incidents and are excluded. Dark Reading, The Hacker News and other outlets are cited by the source but not provided. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: Tech Times · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"done","text":"Cursor fixed the flaw on July 13, 2026 without an advisory or CVE; Mindgard published its writeup on July 14.","quote":"Cursor quietly fixed this on July 13, 2026, one day before AI security firm Mindgard published its full technical writeup after a seven-month disclosure process that produced silence, a broken bug bounty automation, an initial rejection, and no status updates.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.techtimes.com/articles/320797/20260717/cursor-patched-silent-repo-poisoning-zero-day-no-advisory-no-cve.htm"]},"analysis":{"sections":{"timeline":[{"text":"Mindgard discovers the flaw and reports it to Cursor's security email; no confirmation arrives.","quote":"Mindgard discovered the flaw on December 15, 2025, and reported it the same day to Cursor's published security email address.","source_index":0,"when":"2025-12-15"},{"text":"HackerOne reopens the report after Mindgard's challenge and confirms the details were delivered to Cursor.","quote":"HackerOne reopened the report, reproduced the vulnerability, and confirmed on January 20 that the details had been delivered to Cursor.","source_index":0,"when":"January 20"},{"text":"Mindgard tells HackerOne it intends to go public.","quote":"On June 1, 2026, Mindgard informed HackerOne that it intended to go public.","source_index":0,"when":"2026-06-01"},{"text":"Cursor quietly fixes the flaw.","quote":"Cursor quietly fixed this on July 13, 2026, one day before AI security firm Mindgard published its full technical writeup after a seven-month disclosure process that produced silence, a broken bug bounty automation, an initial rejection, and no status updates.","source_index":0,"when":"2026-07-13"},{"text":"Cursor has issued no public advisory, CVE or patched version number.","quote":"As of July 17, the company has issued no public security advisory, assigned no CVE, and told no one which version number contains the fix, according to reporting by Dark Reading and The Hacker News.","source_index":0,"when":"2026-07-17"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.techtimes.com/articles/320797/20260717/cursor-patched-silent-repo-poisoning-zero-day-no-advisory-no-cve.htm"]}}