8.1 HighCWE-862
CVE-2026-26268
cursor vulnerability
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 25 Oct
0.7%probability of exploitation in the next 30 days
Higher than 53% of scored CVEs
SeverityCVSS
8.1High
Description NVD
Cursor is a code editor built for programming with AI. Sandbox escape via writing .git configuration was possible in versions prior to 2.5. A malicious agent (ie prompt injection) could write to improperly protected .git settings, including git hooks, which may cause out-of-sandbox RCE next time they are triggered. No user interaction was required as Git executes these commands automatically. Fixed in version 2.5.
Coverage 1 article · 1 outlet
- Google Fixes CVSS 10 Gemini CLI CI RCE and Cursor Flaws Enable Code ExecutionThe Hacker News · first in our coverage