Cursor's Git Hook Trap: One Clone, Full RCE (CVE-2026-26268)

You clone an interesting open-source repo someone linked on Twitter. You open it in Cursor. You tell the agent: "summarize this codebase." The agent reads files, makes notes, then — being helpful — commits its notes to a scratch branch. The repo had a pre-commit hook. The hook ran. The hook was malicious.

That's CVE-2026-26268 in a sentence. High severity. Arbitrary code execution. Triggered by ordinary use of the IDE on a repo you don't control.

The bug isn't subtle. The lesson is.

1. What actually happens

Step by step:

1. Attacker publishes a repo. It looks like a useful tool, a tutorial, a model card — whatever. Inside is a normal project plus a populated .git/hooks/pre-commit file. (Note: git hooks are technically not shared by default through git clone — the attack variants either use core.hooksPath pointed at a tracked directory, or use embedded sub-repositories with their own .git directories.)
2. You clone, you open in Cursor. Cursor indexes the codebase. Agent mode is on.
3. You ask the agent to do something useful. "Summarize this." "Run the tests." "Try fixing the README typo." Anything that has the agent run git add,git commit,git rebase, or anything that triggers a hook.
4. The hook fires. Pre-commit hooks run as your user, with your environment. They can read ~/.aws/credentials,~/.ssh/id_rsa, your shell history, anything you can read.

You did not approve anything. The agent did not prompt you. The IDE didn't warn you. Cursor's allowlist doesn't see hook execution as a separate event — it just sees git commit, which it has approved.

2. Why this was always going to bite

Git hooks have lived in .git/hooks/ since git was invented in 2005. The threat model has always been: hooks are local. You install hooks yourself. If a hook runs, you put it there.

That threat model survived 20 years of human developers. It broke the instant an agent started running git commands autonomously on repos the user hadn't manually reviewed.

This is a recurring shape across all the 2026 AI-tool CVEs: features that were safe under the assumption "the human is reading every file before acting on it" became dangerous when an agent started acting first. The hook is the same hook. The trust context changed.

3. Cursor 2026 — three CVEs, one theme

CVE-2026-26268 isn't alone. Cursor disclosed three CVEs in the first half of 2026, all of them variations on "the agent moved faster than the safety check":

Each of these is patched. The class isn't. As long as IDEs add agent autonomy faster than they add corresponding safety checks, the next CVE is already incubating.

4. A 60-second per-repo audit

Run this in any freshly cloned repo before you open it in Cursor:

# 1. List git hooks (real-world: most repos have none)
ls -la .git/hooks/ | grep -v "\.sample$"

# 2. Check for custom hooks path pointed at tracked files
git config --get core.hooksPath

# 3. Sub-repos with their own .git/hooks
find . -mindepth 2 -name "hooks" -path "*/.git/*"

# 4. Cursor rules — any invisible Unicode?
ls .cursor/rules/*.mdc .cursorrules 2>/dev/null
perl -CSDA -ne 'print "$ARGV:$.\n" if /[\x{200B}-\x{200F}\x{E0000}-\x{E007F}]/' \
  .cursor/rules/*.mdc .cursorrules 2>/dev/null

# 5. MCP config — any shell-command servers?
cat .cursor/mcp.json 2>/dev/null

Anything that returns content you can't explain is the line where you stop and read before letting the agent touch anything.

5. Fixes — patch, posture, scanner

Patch: update Cursor to the patched version. The fix refuses to run git commands inside a repo with non-empty .git/hooks/ or a non-default core.hooksPath until you approve.

Posture: change your default flow when opening unfamiliar repos.

1. Clone, then run the 60-second audit above.
2. Open in Cursor with agent mode OFF.
3. Skim the codebase yourself.
4. Turn agent mode on only after you're satisfied the repo's config and hooks are safe.

Scanner: ShipSafe ships rules for:

• ai-agent/cursor-auto-run-enabled — flags repos where Auto-Run / YOLO mode is on.
• ai-agent/agent-allowlist-disabled — flags repos that disable the allowlist.
• llm/agent-writes-to-git-hooks — flags code in your own app that writes to .git/hooks/ based on agent or external input (the application-side variant of this attack).

The bottom line

CVE-2026-26268 is a patched bug in a specific IDE. It's also a preview of every agent-autonomy-vs-trust-context CVE that hasn't been written yet. Whenever an agent can act faster than a human can review, the old assumptions about "this is safe because a developer wouldn't do that" get reset.

See also: Cursor Security Risks for the 2025 baseline.