CVE Intelligence
Analysis AI-assisted

CVE-2026-26268: Cursor sandbox escape via Git hooks

CVE-2026-26268 affects Cursor versions before 2.5, where a sandbox escape was possible by writing to .git configuration, including git hooks. According to the record, a malicious agent influenced by prompt injection could write to insufficiently protected Git settings, which may lead to code execution outside the sandbox the next time Git triggers those hooks. The NVD CVSS score is 9.9, and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Cursor is an AI-assisted code editor. According to the CVE record, versions before 2.5 allowed a sandbox escape by writing to Git configuration under the .git directory, including git hooks. The record classifies the weakness as missing authorization (CWE-862).

Impact

  • The record describes possible out-of-sandbox remote code execution when Git later triggers the modified hooks.
  • The record states that no user interaction is required, because Git runs these hooks automatically.
  • The NVD CVSS score is 9.9. GitHub-assigned scores in the record are 8.1 and 8.0. The NVD vector indicates high confidentiality, integrity and availability impact with a changed scope.

Affected products and versions

  • Anysphere Cursor: before 2.5.
  • Cursor Cursor: before 2.5.
  • The record's fix version is 2.5, taken from the description. The structured fixes list in the record is empty.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted. The SSVC fields in the record show exploitation as none and automatable as no.

Remediation and mitigation

  • Upgrade Cursor to version 2.5 or later, as stated in the record.
  • Until the update is applied, limit the ability of AI agents to write to .git directories and hook files where the environment allows it.
  • Review repositories from untrusted sources before opening them with agent features enabled.
  • Consult the vendor advisory for official guidance.

Detection guidance

  • Monitor changes to .git configuration files and hook directories in repositories used with Cursor.
  • Treat unexpected hook files or configuration changes as suspicious and review them before further Git operations run.

Limitations of the available information

  • The record does not describe the exact sandbox boundary or which hook types were affected.
  • The record's structured fixes list is empty, so the fixed version relies on the description text.
  • EPSS values are present (probability 0.00476, percentile 0.40142). These are probability estimates and do not confirm exploitation.

Frequently asked questions

Which Cursor versions are affected by CVE-2026-26268?

The record lists Cursor versions before 2.5 for both affected product entries. The description says the issue was fixed in version 2.5.

Is this vulnerability known to be exploited in the wild?

No. The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Does an attacker need user interaction?

The record states that no user interaction is required, because Git executes the affected hooks automatically.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.