CVE-2026-63093 is an untrusted search path vulnerability in Anysphere, Inc.'s Cursor for Windows version 3.2.16. The product automatically resolves and executes a workspace-resident git.exe binary during IDE startup and on a recurring timed cadence. An attacker who places a malicious git.exe in the root of a cloned repository can cause Cursor to run this malicious binary with the current user's privileges, enabling arbitrary code execution without user interaction.

Successful exploitation allows remote attackers to execute arbitrary code on the victim's machine with the privileges of the current user. This can lead to compromise of the user's environment, data theft, or further attacks within the user's context. The vulnerability requires the victim to clone and open a crafted repository, but no additional user interaction is needed once the repository is opened.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid cloning and opening untrusted repositories with Cursor version 3.2.16. Monitoring for updates from Anysphere, Inc. is recommended to apply any forthcoming patches or mitigations.