Expired50% confidencePredictionExact time
When combined with supply chain attacks, this vulnerability allows attackers to simply embed a disguised git.exe in a popular open-source package, silently triggering execution on the machines of tens of thousands of Cursor users worldwide.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
7/21/2026
First Seen
This claim has expired. It is kept for the record and no longer describes the current state.
Valid until: 10/19/2026(expired)
Sources
Related Claims
UnverifiedIn historical reports on mainstream bug bounty platforms such as HackerOne and Bugcrowd, exposed configuration files and .git directories are among the most frequently rewarded high-value vulnerability types.74% similarUnverified该漏洞的技术本质是PATH劫持攻击，Cursor执行Git操作时会从项目目录中查找并调用git可执行文件74% similarUnverifiedSysdig published a report analyzing an attack case named JadePuffer, a fully autonomous LLM agent capable of breaking into servers, stealing credentials, moving laterally, encrypting databases, and leaving a ransom note.71% similarUnverified勒索软件攻击者往往会在潜伏数周至数月后才触发加密程序，期间通过横向移动渗透备份系统、域控制器等关键节点70% similarUnverified2021年曝光的QNAP NAS勒索软件事件（eCh0raix/QNAPCrypt）中，攻击者利用暴露在公网的管理界面实施攻击，感染量超过数万台69% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/579926API
curl https://kongchang.com/api/v1/knowledge/claims/579926MCP
get_claim(id=579926)