Cursor IDE auto‑executes malicious git.exe from repo roots, enabling silent code execution
Cursor on Windows runs any git.exe found in a repository’s root when the project is opened, without prompts or user consent. This lets an attacker ship a poisoned repo that executes arbitrary code with the user’s privileges, exposing millions of developers to silent compromise.