Binary-Planting - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/binary-planting/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 17 Jul 2026 15:18:04 +0000CVE-2026-63093: Binary Planting Vulnerability in Cursor for Windowshttps://feed.craftedsignal.io/briefs/2026-07-cve-2026-63093-cursor-binary-planting/Fri, 17 Jul 2026 15:18:04 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-cve-2026-63093-cursor-binary-planting/CVE-2026-63093 describes a binary planting vulnerability in Cursor for Windows version 3.2.16 that allows a remote attacker to achieve arbitrary code execution by placing a malicious `git.exe` file in a crafted repository's root, which the Cursor IDE automatically executes during startup or on a recurring cadence when a developer opens the repository, running the malicious binary under the privileges of the current user.CVE-2026-63093 identifies a critical binary planting vulnerability affecting Cursor for Windows, specifically version 3.2.16. This flaw enables remote attackers to execute arbitrary code on a victim's system. The mechanism involves an attacker crafting a malicious Git repository containing a specially prepared git.exe executable in its root directory. When an unsuspecting developer clones and subsequently opens this crafted repository within the vulnerable Cursor IDE, the application automatically resolves and executes the workspace-resident malicious git.exe binary. This execution occurs without any further user interaction, both during the IDE's startup phase and at regular, timed intervals, granting the attacker code execution capabilities under the privileges of the user running Cursor. This vulnerability poses a significant supply chain risk, as developers could unknowingly introduce malware into their development environments simply by interacting with a seemingly legitimate code repository.

Attack Chain

  1. An attacker crafts a malicious Git repository containing a hostile git.exe binary placed in the repository's root directory.
  2. The attacker publishes or otherwise makes this crafted repository available to target developers (e.g., via a phishing campaign, compromised repository, or social engineering).
  3. A developer clones the malicious repository to their local machine using any Git client.
  4. The developer opens the newly cloned repository within the vulnerable Cursor for Windows IDE (version 3.2.16 or earlier).
  5. Upon opening the repository or during a recurring background process, the Cursor IDE automatically attempts to resolve and execute the git.exe binary.
  6. Due to the binary planting vulnerability, Cursor preferentially executes the malicious git.exe located within the repository's root instead of the legitimate git.exe installed on the system.
  7. The malicious git.exe executes arbitrary code on the developer's system, inheriting the privileges of the user running Cursor.
  8. The attacker achieves arbitrary code execution, potentially leading to full system compromise, data exfiltration, or further network lateral movement.

Impact

Successful exploitation of CVE-2026-63093 leads to arbitrary code execution on the compromised developer's workstation. This gives attackers the ability to install additional malware, exfiltrate sensitive source code, steal credentials, establish persistence, or pivot into other systems within the organization's network. The nature of the attack, targeting developers' IDEs, makes it a potent vector for supply chain attacks, potentially compromising software projects and their end-users. The CVSS v3.1 Base Score of 8.8 reflects the severe consequences of this vulnerability.

Recommendation

  • Patch CVE-2026-63093 immediately by updating Cursor for Windows to a version beyond 3.2.16 as soon as a fix is available from the vendor.
  • Deploy the provided Sigma rule "Detect CVE-2026-63093 Exploitation - Malicious git.exe Execution" to your SIEM to identify suspicious git.exe executions originating from the Cursor IDE process.
  • Enable process creation logging, such as via Sysmon, to ensure the process_creation log source is captured for effective detection.
  • Educate developers about the risks of cloning and opening untrusted repositories, emphasizing code review and supply chain security best practices.
]]>highadvisorybinary-plantingidevulnerabilityexecutionwindows