CVE-2026-63093 is an untrusted search path vulnerability in Anysphere, Inc.'s Cursor for Windows version 3.2.16. The vulnerability arises because Cursor automatically resolves and executes a workspace-resident git.exe binary found in the root directory of a cloned repository. An attacker can exploit this by planting a malicious git.exe in the repository root, which Cursor will execute during IDE startup and on a recurring timed cadence without user interaction. This leads to arbitrary code execution under the current user's privileges.

Successful exploitation allows remote attackers to execute arbitrary code with the privileges of the current user. This can lead to compromise of the user's system and any data accessible by that user. The vulnerability does not require user interaction beyond opening the crafted repository, increasing the risk of exploitation. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid opening repositories from untrusted sources or containing unexpected git.exe files in the root directory. Monitoring for suspicious git.exe files in workspace directories may help reduce risk.