Unverified50% confidenceFactExact time
该漏洞的技术本质是PATH劫持攻击，Cursor执行Git操作时会从项目目录中查找并调用git可执行文件
1
Sources
50%
Confidence
Long-term
Relevance
7/21/2026
First Seen
Sources
Related Claims
UnverifiedIn historical reports on mainstream bug bounty platforms such as HackerOne and Bugcrowd, exposed configuration files and .git directories are among the most frequently rewarded high-value vulnerability types.76% similarUnverifiedWhen combined with supply chain attacks, this vulnerability allows attackers to simply embed a disguised git.exe in a popular open-source package, silently triggering execution on the machines of tens of thousands of Cursor users worldwide.74% similarUnverifiedNormal Security披露的GitLost研究指出，当AI编程代理能访问多个仓库时，一条公开issue可能成为数据泄露入口71% similarUnverifiedExploitGym is a benchmark for evaluating AI cybersecurity offensive and defensive capabilities, requiring models to convert known software vulnerabilities (CVEs) into complete end-to-end exploit code, with full marks only awarded for using the vulnerability intended by the question.68% similarUnverifiedSysdig published a report analyzing an attack case named JadePuffer, a fully autonomous LLM agent capable of breaking into servers, stealing credentials, moving laterally, encrypting databases, and leaving a ransom note.68% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/578029API
curl https://kongchang.com/api/v1/knowledge/claims/578029MCP
get_claim(id=578029)