Cursor 0day: When Full Disclosure Becomes the Only Protection Left

Re:Cursor 0day: When Full Disclosure Becomes the Only Protec... by dhpe on Tuesday July 14, 2026 @11:06PM (#48915767)

There's discussion whether this is a vuln. While some responsibility should be on the user to already having downloaded a malicious binary, I think it's poor default behavior from cursor to run git from the repo root. Is it really a use case to have git.exe in a git repo — more like a red flag.

[ Parent | on HN ]

Re:Cursor 0day: When Full Disclosure Becomes the Only Protec... by cute_boi on Tuesday July 14, 2026 @11:15PM (#48915825)

> While some responsibility should be on the user

User should always be responsible before downloading pdf, excel and its macros. There are so many way things can get infected..

[ Parent | on HN ]

Re:Cursor 0day: When Full Disclosure Becomes the Only Protec... by TZubiri on Wednesday July 15, 2026 @12:37AM (#48916346)

Critical difference is that PDF is a data file, while a git.exe is an executable marked to the OS as executable.

[ Parent | on HN ]

Re:Cursor 0day: When Full Disclosure Becomes the Only Protec... by brookst on Wednesday July 15, 2026 @12:38AM (#48916355)

When you clone a git repo, do you check whether there are PDFs in it?

[ Parent | on HN ]

Re:Cursor 0day: When Full Disclosure Becomes the Only Protec... by iainmerrick on Wednesday July 15, 2026 @08:38AM (#48919936)

If it happens out of the box with fresh installations of both Windows and Cursor, I’d say it’s a serious vulnerability in at least one of those.

Sounds like this is a golden oldie bug on Windows/DOS, which I assume is now patched by default. If so it’s Cursor’s problem.

[ Parent | on HN ]