Cursor < 2.5 RCE (GHSA-8pcm-8jpx-hv8r)

The version of Cursor installed on the remote host is prior to 2.5. It is, therefore, affected by a remote code execution vulnerability: - A malicious agent ie prompt injection could write to improperly protected .git settings, including git hooks, which may cause out-of-sandbox remote code...

CVE-2026-26268

creationtimestamp| type| source ---|---|--- 2026-02-13 17:54:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mer3ai5fiw23 2026-04-29 11:50:19+00:00| seen| https://bsky.app/profile/eyalestrin.bsky.social/post/3mkmztuqow32z 2026-04-30 04:45:12+00:00| seen|...

CVE-2026-26268

Cursor is a code editor built for programming with AI. Sandbox escape via writing .git configuration was possible in versions prior to 2.5. A malicious agent ie prompt injection could write to improperly protected .git settings, including git hooks, which may cause out-of-sandbox RCE next time th...