CVE-2026-26268 is a high severity (CVSS 8.0) sandbox escape in Cursor, the AI code editor. In versions before 2.5, a malicious agent, for example one steered by prompt injection, could write to protected Git settings such as hooks and later run code outside the sandbox. Update to Cursor 2.5 or later.
What's affected
The Cursor security advisory (GHSA-8pcm-8jpx-hv8r) lists affected versions as anything before 2.5 and the patched version as 2.5. No package is listed, since this is a desktop application and not a library.
The NVD record matches: sandbox escape through writing .git configuration was possible before 2.5, and version 2.5 contains the fix.
The advisory notes that no user interaction was needed on the part of the developer once the settings were written, because Git runs hooks on its own when certain commands are used.
How to check if you're exposed
Check the Cursor version on every developer machine. In the application, open the About dialog from the Cursor menu. From a terminal, the command line launcher can print it if you installed it:
cursor --version
Anything below 2.5 needs the update.
If you manage laptops centrally, add the Cursor version to your software inventory. Developer tools update on their own schedule and often fall outside normal patching.
Then look for signs that Git configuration was changed in repositories where the agent worked. In a repository, list which hooks exist and which are real scripts instead of the default samples:
ls -la .git/hooks | grep -v '\.sample'
git config --show-origin --list | grep -i hook
A hook you did not create, or a core.hooksPath pointing somewhere unexpected, deserves a closer look. The advisory does not describe an indicator of compromise, so treat this as a general review, not a detection rule.
What to do now
- Update Cursor to version 2.5 or later on every machine that has it installed. Confirm the version afterwards.
- Review repositories where an AI agent had write access before the update. Check
.git/hooksand the Git configuration for entries you did not add. - Until you have updated, avoid pointing an agent at untrusted content such as unknown repositories, issue text or web pages, since prompt injection is the described way in.
- Keep agent permissions narrow. An agent that can only edit source files in a project folder has less to abuse than one that can also change Git settings.
- Add a note to your developer onboarding material: AI editors are software with their own update cycle and their own advisories.
Why it matters
The weakness is CWE-862, missing authorization. The sandbox was supposed to stop the agent from writing to certain files. Git configuration and hooks were not protected well enough, so the agent could write there. Git hooks are scripts that Git runs on events such as commits. A script placed by the agent runs with the developer's own rights, outside the sandbox, the next time Git triggers it.
The CVSS vector is CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. The scope is changed, which is CVSS language for a flaw in one component that reaches resources beyond it. That fits a sandbox escape: the harm lands outside the boundary the sandbox was meant to hold. Attack complexity and required privileges are both rated high, which is why the score is 8.0 and not higher.
The interesting part is the attack path. Nobody needs to trick the developer into running a file. The path starts with the agent reading attacker influenced text, and the agent itself writes the dangerous file. That makes prompt injection a code execution problem, not only a data leakage problem, whenever the agent can touch files that other programs execute later.
The record is not on the CISA Known Exploited Vulnerabilities list, and the advisory does not say it has been exploited.
For security teams, the practical takeaway is to treat files that tools run automatically as part of the agent's blast radius. Git hooks are one. Editor task files, build scripts and shell profiles are others. A sandbox is only as good as its list of protected paths, and a fixed version closes only the paths on that list.
It is also a reminder to count developer tools in your inventory. A scan of your dependencies will not find an editor on a laptop, so keep a separate record of the tools and agents your engineers use, who owns them, and how updates reach them.
Quick check
Is Cursor 2.5 the fixed version for CVE-2026-26268?
Yes. The advisory lists versions before 2.5 as affected and says the fix is in version 2.5.
Does this need the developer to click anything?
The advisory says no user interaction was required, because Git executes the hooks automatically once they are in place. The attack path begins with a malicious agent, for example through prompt injection.
Sources
Last reviewed: 19 October 2026.
