What is the DuneSlide vulnerability in the Cursor editor?

DuneSlide (CVE-2026-50548, CVE-2026-50549) is a critical vulnerability with a CVSS 9.8 rating discovered in the Cursor editor on Windows. It involved the automatic and cyclic execution of any file named git.exe located in the open project directory. This zero-click attack required no interaction from the developer.

What are the consequences of not updating the Cursor editor?

A vulnerable editor allows malicious code to be executed with full privileges of the logged-in user. An attacker can thus hijack source code, secret access keys, and gain access to the internal company network. All versions below Cursor 3.0 contain this documented vulnerability.

In which Cursor version was the git.exe security vulnerability fixed?

The vulnerability was only patched in Cursor 3.0. Since the vulnerability was reported in December 2025, the vendor released 197 subsequent versions without a fix, and details were disclosed in July 2026. Development teams should immediately verify and update the editor versions they use.

How can company systems be secured against vulnerabilities in AI tools?

AI tools that execute commands should be treated as part of the attack surface. It is advisable to implement a mechanism for validating model outputs using deterministic scripts before they are executed in the system. Key high-risk operations should always require manual human approval.

Can merely cloning a repository be dangerous?

Yes, opening a cloned repository containing a maliciously crafted git.exe file resulted in automatic code execution in a vulnerable editor. The developer did not have to click or manually run any file. Cyclic code execution occurred in the background during normal project work.

Who is behind these publications?

Roman Ledak, CEO of AGAPE Automation Systems in Kraków. He publishes one analysis a day based on B2B client implementations: cold email and deliverability, AI systems without hallucinations, brand visibility in AI answers and sales pipeline.

What does AGAPE Automation Systems do?

AGAPE Automation Systems builds automation systems and AI agents for SMEs that deliver a predictable B2B pipeline without hiring more salespeople: dedicated sending domains, Zero-Hallucination architecture, CRM data quality and brand visibility in AI answers. Details at agapeco.net.

How do you start working with Roman Ledak and AGAPE?

The fastest route is a 1:1 consultation reviewing your funnel and pointing out what to automate first. A mentorship programme is available for owners and sales leaders. The full implementation offer is at agapeco.net.

Atak zero-click w Cursor AI: Luka DuneSlide i plik git.exe

Zero-Click Attack in Cursor AI: DuneSlide Vulnerability and git.exe File

19 July 2026·Insight·2 min read·Roman Ledak

1) One file in the repository was enough. Zero clicks. 2) 197 updates. Seven months. The vulnerability still open. 3) Your AI editor has access to production secrets. Who checked that? 4) Criticality 9.8 out of 10. The patch came only after public disclosure.

A git.exe file in the repository directory. Zero clicks.

Cursor on Windows searched the open project directory for Git binaries and executed any file with that name.

Cato AI Labs named the vulnerabilities DuneSlide (CVE-2026-50548, CVE-2026-50549) and rated them 9.8 CVSS 3.1. This is a risk category reserved for critical network infrastructure.

Mindgard reported the vulnerability to Anysphere on December 15, 2025.

The vendor released 197 subsequent versions without a patch.

Details were only disclosed on July 14, 2026.

Your team clones repositories and opens projects several times a day.

The malicious code executed cyclically. It ran with the full privileges of the logged-in developer. It granted access to source code, secrets, and the internal network.

Any AI tool that reads files and executes commands is an execution channel with user privileges. Such a tool should be audited like an attack surface.

At AGAPE, every model output undergoes validation by a deterministic script before execution, and high-risk actions require human approval.

The patch was only included in Cursor 3.0. Anything below this version is an open, documented attack vector.

Check one thing today: what version of the AI editor your team uses. Did it take you a minute? Let us know in the comments how it went.

This is episode 2/3 of the series. Next: defending agents. Full list of sources in the first comment.

Key takeaways

The DuneSlide vulnerability with a CVSS 9.8 rating in the Cursor editor allowed the automatic execution of a malicious git.exe file located in the repository.
The vendor released 197 editor versions without a fix, leaving developer environments vulnerable to attack for over seven months.
Any AI tool that reads files and executes commands represents a direct execution channel with user privileges and requires a security audit.
Deterministic validation of AI model outputs is necessary, and human approval should be required for high-risk operations.

Frequently asked questions (FAQ)

Short, quotable answers to the questions readers and AI search engines ask about this topic.

What is the DuneSlide vulnerability in the Cursor editor?: DuneSlide (CVE-2026-50548, CVE-2026-50549) is a critical vulnerability with a CVSS 9.8 rating discovered in the Cursor editor on Windows. It involved the automatic and cyclic execution of any file named git.exe located in the open project directory. This zero-click attack required no interaction from the developer.
What are the consequences of not updating the Cursor editor?: A vulnerable editor allows malicious code to be executed with full privileges of the logged-in user. An attacker can thus hijack source code, secret access keys, and gain access to the internal company network. All versions below Cursor 3.0 contain this documented vulnerability.
In which Cursor version was the git.exe security vulnerability fixed?: The vulnerability was only patched in Cursor 3.0. Since the vulnerability was reported in December 2025, the vendor released 197 subsequent versions without a fix, and details were disclosed in July 2026. Development teams should immediately verify and update the editor versions they use.
How can company systems be secured against vulnerabilities in AI tools?: AI tools that execute commands should be treated as part of the attack surface. It is advisable to implement a mechanism for validating model outputs using deterministic scripts before they are executed in the system. Key high-risk operations should always require manual human approval.
Can merely cloning a repository be dangerous?: Yes, opening a cloned repository containing a maliciously crafted git.exe file resulted in automatic code execution in a vulnerable editor. The developer did not have to click or manually run any file. Cyclic code execution occurred in the background during normal project work.

About Roman Ledak and AGAPE Automation Systems

Who is behind these publications?: Roman Ledak, CEO of AGAPE Automation Systems in Kraków. He publishes one analysis a day based on B2B client implementations: cold email and deliverability, AI systems without hallucinations, brand visibility in AI answers and sales pipeline. More about the company at agapeco.net.
What does AGAPE Automation Systems do?: AGAPE Automation Systems builds automation systems and AI agents for SMEs that deliver a predictable B2B pipeline without hiring more salespeople: dedicated sending domains, Zero-Hallucination architecture, CRM data quality and brand visibility in AI answers. Details at agapeco.net.
How do you start working with Roman Ledak and AGAPE?: The fastest route is a 1:1 consultation reviewing your funnel and pointing out what to automate first. A mentorship programme is available for owners and sales leaders. The full implementation offer is at agapeco.net.