STUPID-2026-0029

Malicious cloned repository triggered code execution in Cursor on Windows

8.0high
July 15, 2026Source checked

Why 8/10

Cloning a malicious repo could run code on a Windows machine and expose secrets. It needs the victim to clone; demonstrated, not observed in the wild.

Scope
3/4
A whole machine or drive, an organisation's production system or data, or many credentials
Recoverability
3/3
Permanently lost or irreversible, including data that was exposed
Did it happen
1/2
Demonstrated (proof of concept, reproduction, controlled test or near-miss) with no real victim reported
Beyond the user
1/1
Production systems, customers or third parties, or credentials and sensitive personal data

The score is the sum of these four factors. How each factor is scored · scored 2026-10-29

  1. Instruction given

    Open and work on a freshly cloned repository in the Cursor editor.

  2. Expected behavior

    Opening or cloning a repository should never execute code from that repository without explicit user action.

  3. Actual behavior

    A crafted repository could trigger code execution on Windows simply by being cloned and opened in Cursor, turning the routine act of inspecting untrusted code into a compromise of the developer's machine.

  4. Damage

    The flaw converted a normal developer workflow — cloning a repo to look at it — into a remote code execution vector on Windows hosts, exposing local secrets and source.

Full write-up

A vulnerability disclosed in July 2026 allowed a malicious cloned repository to trigger code execution in the Cursor editor on Windows. Reviewing untrusted code by cloning and opening it is one of the most common things a developer does, and the flaw turned that routine action into a compromise of the local machine — no explicit 'run' step required. Code execution on the host exposed whatever credentials, tokens, and source the developer's environment could reach. It is part of a broader pattern in which AI coding tools blur the line between opening code and executing it.

Classification

Agent
Cursor
Failure mode
Security Vulnerability
Root cause
Tool Misuse
Domain
Infra
OWASP Agentic Top 10 (our mapping)
ASI05 Unexpected Code Execution (RCE) list
MIT AI Risk Repository (our mapping)
2.2 AI system security vulnerabilities and attacks taxonomy
Source
News Report

Related incidents

8.0
GitHub Copilot CLI ran arbitrary attacker commands via a nested bare git repository abusing core.fsmonitor (CVE-2026-45033)
9.0
Clinejection: an AI issue-triage workflow enabled arbitrary code execution on the CI runner
9.0
Cursor's terminal sandbox trusted an agent-set working directory, letting zero-click prompt injection escape it and gain code execution (CVE-2026-50548)
9.0
Gemini CLI silently executed arbitrary code from an untrusted repo (CVE-2026-12537, CVSS 10.0)
Discuss on Hacker News
Cite this record
StupidLLM. "STUPID-2026-0029: Malicious cloned repository triggered code execution in Cursor on Windows." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0029/ (accessed 2026-10-30). CC BY 4.0.

← STUPID-2026-0028By IDSTUPID-2026-0030 →

Get told when an agent breaks something

We document AI agent failures daily, severity-scored against a published scale. Each Monday, if any scored 7 or above that week — deleted data, leaked secrets, broken production — you get one email with the sources. When nothing did, you get nothing.

This database is callable over MCP — query it from inside your agent.