Critical Cursor Vulnerability Exposes Developer Workstations To Remote Code Execution

Novee researchers disclosed CVE-2026-26268, a high-severity RCE vulnerability in the Cursor AI IDE where an attacker can hide a malicious bare repository containing a Git hook inside a cloned repo; Cursor's autonomous AI agent may perform Git operations (such as checkouts) driven by repository rules and inadvertently execute the malicious hook, exposing developer workstations and sensitive credentials.