Cursor IDE Executes Malicious Git Binary from Repository Root

CVE-2026-63093 is a binary planting vulnerability in Cursor for Windows (version 3.2.16) that enables arbitrary code execution through a trojanized git.exe file placed in a repository root directory. The vulnerability is critical because Cursor automatically discovers and executes this workspace-resident binary during IDE startup and on recurring timed intervals without requiring user interaction or consent. This affects developers using Cursor who clone repositories from untrusted or compromised sources, as the malicious git.exe runs with the privileges of the current user—potentially allowing attackers to steal credentials, inject malware, exfiltrate source code, or establish persistence on developer workstations.

While Casky.ai currently has 0 mapped skills directly addressing this specific CVE, the underlying attack pattern maps to privilege escalation and execution techniques that Claude AI with extended reasoning can help practitioners identify. A Casky user would observe indicators aligned with MITRE ATT&CK's Execution and Persistence tactics—specifically suspicious binary execution from unexpected file paths, unsigned executables loaded from repository directories, and recurring process launches tied to IDE initialization. By correlating process creation events, file system monitoring, and execution context, practitioners using Casky's analytical framework can detect when development environments are spawning binaries from workspace roots rather than expected system or application directories, enabling faster isolation of compromised repositories and prevention of code execution before damage occurs.