[bragr]

I think this is slightly less of a Cursor bug than a bit of a Windows quirk: Windows searches the current working directory for executables before resorting to the path variable. I imagine a lot of stuff is vulnerable to such an "attack" on Windows.

[ncruces]

Stuff that cares about security fixes this, though:

https://go.dev/blog/path-security

The functions Command and LookPath look for a program in the directories listed in the current path, following the conventions of the host operating system. Operating systems have for decades included the current directory in this search, sometimes implicitly and sometimes configured explicitly that way by default. Modern practice is that including the current directory is usually unexpected and often leads to security problems.

https://pkg.go.dev/os/exec#hdr-Executables_in_the_current_di...

[shitter]

Yeah, but you can easily mitigate it by searching for the real git in known system locations and using whatever you find there (or allowing the user to configure the path). I believe that's how VSCode does it

[Chu4eeno]

Yes, but it's an old known security gotcha people developing for Wintendo have to guard against.

[whateveracct]

that sounds like Cursor has a bug and vuln on Windows to me