CVE-2026-26268

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26268", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-12T17:10:53.413Z", "datePublished": "2026-02-13T16:54:04.712Z", "dateUpdated": "2026-02-13T21:12:35.045Z"}, "containers": {"cna": {"title": "Cursor sandbox escape via Git hooks", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/cursor/cursor/security/advisories/GHSA-8pcm-8jpx-hv8r", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/cursor/cursor/security/advisories/GHSA-8pcm-8jpx-hv8r"}], "affected": [{"vendor": "cursor", "product": "cursor", "versions": [{"version": "< 2.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-13T16:54:04.712Z"}, "descriptions": [{"lang": "en", "value": "Cursor is a code editor built for programming with AI. Sandbox escape via writing .git configuration was possible in versions prior to 2.5. A malicious agent (ie prompt injection) could write to improperly protected .git settings, including git hooks, which may cause out-of-sandbox RCE next time they are triggered. No user interaction was required as Git executes these commands automatically. Fixed in version 2.5."}], "source": {"advisory": "GHSA-8pcm-8jpx-hv8r", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-13T21:12:25.276272Z", "id": "CVE-2026-26268", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-13T21:12:35.045Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26268", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-13T21:12:25.276272Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-13T21:12:30.464Z"}}], "cna": {"title": "Cursor sandbox escape via Git hooks", "source": {"advisory": "GHSA-8pcm-8jpx-hv8r", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "cursor", "product": "cursor", "versions": [{"status": "affected", "version": "< 2.5"}]}], "references": [{"url": "https://github.com/cursor/cursor/security/advisories/GHSA-8pcm-8jpx-hv8r", "name": "https://github.com/cursor/cursor/security/advisories/GHSA-8pcm-8jpx-hv8r", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Cursor is a code editor built for programming with AI. Sandbox escape via writing .git configuration was possible in versions prior to 2.5. A malicious agent (ie prompt injection) could write to improperly protected .git settings, including git hooks, which may cause out-of-sandbox RCE next time they are triggered. No user interaction was required as Git executes these commands automatically. Fixed in version 2.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-13T16:54:04.712Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26268", "state": "PUBLISHED", "dateUpdated": "2026-02-13T21:12:35.045Z", "dateReserved": "2026-02-12T17:10:53.413Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-13T16:54:04.712Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "cursor", "vendor": "cursor", "versions": [{"status": "affected", "version": "< 2.5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:anysphere:cursor:*:*:*:*:*:*:*:*", "matchCriteriaId": "1D4650BA-96CA-44D8-B3E5-B69D13EF7D1D", "versionEndExcluding": "2.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cursor is a code editor built for programming with AI. Sandbox escape via writing .git configuration was possible in versions prior to 2.5. A malicious agent (ie prompt injection) could write to improperly protected .git settings, including git hooks, which may cause out-of-sandbox RCE next time they are triggered. No user interaction was required as Git executes these commands automatically. Fixed in version 2.5."}, {"lang": "es", "value": "Cursor es un editor de c\u00f3digo dise\u00f1ado para programar con IA. El escape de la sandbox mediante la escritura de la configuraci\u00f3n .git era posible en versiones anteriores a la 2.5. Un agente malicioso (es decir, inyecci\u00f3n de prompt) podr\u00eda escribir en configuraciones .git protegidas de forma inadecuada, incluyendo los git hooks, lo que podr\u00eda causar RCE fuera de la sandbox la pr\u00f3xima vez que se activen. No se requer\u00eda interacci\u00f3n del usuario, ya que Git ejecuta estos comandos autom\u00e1ticamente. Corregido en la versi\u00f3n 2.5."}], "id": "CVE-2026-26268", "lastModified": "2026-06-17T10:26:00.920", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26268", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-13T21:12:25.276272Z", "version": "2.0.3"}}]}, "published": "2026-02-13T17:16:14.227", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/cursor/cursor/security/advisories/GHSA-8pcm-8jpx-hv8r"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.5)"}}], "product": "cursor", "vendor": "cursor"}], "analysis": {"en": {"generated_at": "2026-04-17T19:51:24.668290+00:00", "value": {"mitigation_remediation": ["Upgrade Cursor to version 2.5 or newer, which removes the insecure handling of .git configuration writes.", "As a temporary measure, delete or disable any existing git hooks in the repository\u2019s .git/hooks directory to eliminate the execution path that can be abused.", "Configure the editor to reject any attempts to modify .git configuration files from AI prompts, ensuring that prompt injection cannot write to the .git directory; alternatively, restrict file system permissions on the .git folder to prevent write access by the editor process."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "This issue affects the Cursor code editor product from cursor:cursor for all releases older than version 2.5. Any deployment using those older versions is vulnerable unless the .git configuration files are manually patched or the application upgraded.", "description_and_impact": "Cursor, a code editor that integrates AI features, had a vulnerability that allowed an attacker to escape the sandbox by writing to improperly protected .git configuration files, including git hooks. This flaw, identified in versions prior to 2.5, permits malicious agent prompts to alter the .git settings, which can lead to execution of arbitrary code outside the sandbox environment. The weakness is a form of missing access control, as the editor fails to enforce proper permissions on these configuration files. The consequence is a high\u2011risk scenario where untrusted input can result in arbitrary code execution without any user interaction.", "risk_and_exploitability": "The CVSS score of 8.1 indicates a high severity, and the EPSS score of less than 1% suggests that exploitation is unlikely at present. Since the flaw relies on Git automatically executing hooks, an attacker can trigger the vulnerability simply by having the editor run Git operations, irrespective of user actions. The attack vector is inferred to be local execution triggered by automatic Git processes, and the exploitation conditions do not require privileged access beyond what a malicious prompt injection can provide. Because the vulnerability is not listed in the CISA KEV catalog, no known widespread exploitation has been reported, but the potential for zero\u2011click remote code execution remains significant for affected installations."}}}}, "created": "2026-02-13T21:28:32.488215+00:00", "updated": "2026-04-17T20:00:09.015134+00:00", "vendors": ["cursor", "cursor$PRODUCT$cursor"]}