[dhpe]

There's discussion whether this is a vuln. While some responsibility should be on the user to already having downloaded a malicious binary, I think it's poor default behavior from cursor to run git from the repo root. Is it really a use case to have git.exe in a git repo — more like a red flag.

[iainmerrick]

If it happens out of the box with fresh installations of both Windows and Cursor, I’d say it’s a serious vulnerability in at least one of those.

Sounds like this is a golden oldie bug on Windows/DOS, which I assume is now patched by default. If so it’s Cursor’s problem.

[cute_boi]

> While some responsibility should be on the user

User should always be responsible before downloading pdf, excel and its macros. There are so many way things can get infected..

[brookst]

When you clone a git repo, do you check whether there are PDFs in it?

[TZubiri]

Critical difference is that PDF is a data file, while a git.exe is an executable marked to the OS as executable.