Loading vulnerability…
Git Hook Sandbox Escape in Cursor
CVE-2026-26268 is a sandbox escape vulnerability in Cursor versions prior to 2.5 caused by missing authorization protections on writes to Git configuration and hooks. A malicious or prompt-injected agent can modify insufficiently protected Git metadata so that subsequent Git operations automatically execute attacker-controlled commands outside the agent sandbox. A repository-based attack can also supply malicious hooks through an embedded bare repository that the agent subsequently operates on. Hook execution requires no additional user approval. Cursor 2.5 fixes the vulnerability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary code execution outside Cursor's agent sandbox with the developer's privileges, compromising the confidentiality, integrity, and availability of resources accessible to that account. Potential consequences include theft of source code and credentials, modification of local files, disruption of development workflows, and access to connected organizational services using available credentials.
If you can’t patch tonight, do this now.
Before allowing the Cursor agent to operate on untrusted repositories, inspect them for embedded bare repositories, malicious Git hooks, and suspicious agent instructions or Cursor Rules. Run untrusted projects in a disposable virtual machine or independently enforced isolated environment, and restrict the environment's access to credentials and sensitive resources. These measures reduce exposure but do not replace upgrading.
Patch, then assume compromise.
Upgrade Cursor to version 2.5 or later, which fixes CVE-2026-26268.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.