Roman Ledak

Zero-Click Attack in Cursor AI: DuneSlide Vulnerability and git.exe File

·Insight·2 min read·Roman Ledak

1) One file in the repository was enough. Zero clicks. 2) 197 updates. Seven months. The vulnerability still open. 3) Your AI editor has access to production secrets. Who checked that? 4) Criticality 9.8 out of 10. The patch came only after public disclosure.

A git.exe file in the repository directory. Zero clicks.

Cursor on Windows searched the open project directory for Git binaries and executed any file with that name.

Cato AI Labs named the vulnerabilities DuneSlide (CVE-2026-50548, CVE-2026-50549) and rated them 9.8 CVSS 3.1. This is a risk category reserved for critical network infrastructure.

Mindgard reported the vulnerability to Anysphere on December 15, 2025.

The vendor released 197 subsequent versions without a patch.

Details were only disclosed on July 14, 2026.

Your team clones repositories and opens projects several times a day.

The malicious code executed cyclically. It ran with the full privileges of the logged-in developer. It granted access to source code, secrets, and the internal network.

Any AI tool that reads files and executes commands is an execution channel with user privileges. Such a tool should be audited like an attack surface.

At AGAPE, every model output undergoes validation by a deterministic script before execution, and high-risk actions require human approval.

The patch was only included in Cursor 3.0. Anything below this version is an open, documented attack vector.

Check one thing today: what version of the AI editor your team uses. Did it take you a minute? Let us know in the comments how it went.

This is episode 2/3 of the series. Next: defending agents. Full list of sources in the first comment.

Key takeaways

  • The DuneSlide vulnerability with a CVSS 9.8 rating in the Cursor editor allowed the automatic execution of a malicious git.exe file located in the repository.
  • The vendor released 197 editor versions without a fix, leaving developer environments vulnerable to attack for over seven months.
  • Any AI tool that reads files and executes commands represents a direct execution channel with user privileges and requires a security audit.
  • Deterministic validation of AI model outputs is necessary, and human approval should be required for high-risk operations.

Frequently asked questions (FAQ)

What is the DuneSlide vulnerability in the Cursor editor?
DuneSlide (CVE-2026-50548, CVE-2026-50549) is a critical vulnerability with a CVSS 9.8 rating discovered in the Cursor editor on Windows. It involved the automatic and cyclic execution of any file named git.exe located in the open project directory. This zero-click attack required no interaction from the developer.
What are the consequences of not updating the Cursor editor?
A vulnerable editor allows malicious code to be executed with full privileges of the logged-in user. An attacker can thus hijack source code, secret access keys, and gain access to the internal company network. All versions below Cursor 3.0 contain this documented vulnerability.
In which Cursor version was the git.exe security vulnerability fixed?
The vulnerability was only patched in Cursor 3.0. Since the vulnerability was reported in December 2025, the vendor released 197 subsequent versions without a fix, and details were disclosed in July 2026. Development teams should immediately verify and update the editor versions they use.
How can company systems be secured against vulnerabilities in AI tools?
AI tools that execute commands should be treated as part of the attack surface. It is advisable to implement a mechanism for validating model outputs using deterministic scripts before they are executed in the system. Key high-risk operations should always require manual human approval.
Can merely cloning a repository be dangerous?
Yes, opening a cloned repository containing a maliciously crafted git.exe file resulted in automatic code execution in a vulnerable editor. The developer did not have to click or manually run any file. Cyclic code execution occurred in the background during normal project work.

Check one thing today: what version of the AI editor your team uses. Did it take you a minute? Let us know in the comments how it went.

Keep reading