Cursor’s Unpatched Zero-Day Lets Repos Run Malicious Code

Security firm Mindgard publicly disclosed an unpatched Cursor vulnerability on July 14, 2026, after the flaw sat unfixed for seven months. A malicious git.exe planted in a repository executes…