ACVE-2026-0006

The configuration

Configuration label

cursor <2.5

Affected entries

• AgentHarness: cursor — SEMVER (introduced 0; fixed 2.5)

Matcher

• all
  • harness.id eq "cursor"
  • harness.version semverRange "<2.5"

Why it is exploitable

What the vulnerability is

Cursor can execute a Git hook supplied by a repository when the harness processes repository content in the affected release range. A Git hook is executable repository metadata, so running it can cross the boundary between inspecting a project and executing code from that project. The fixed boundary in this record is 2.5, but it requires confirmation.

Which configuration is exposed

The matcher exposes Cursor when harness.id is cursor and harness.version is below 2.5. It does not require a particular hook name, repository path, Git command, or permission mode. The rule reports the harness version because the lockfile does not need to enumerate every Git hook; a match means the versioned harness is in the exposure range, not that a hook has run.

How ACVE detects it

ACVE reads harness.id and harness.version. It cannot list repository hooks, determine which hook Git would select, or observe execution. The version boundary is treated as 2.5 (unverified — see Grounding needed), so the finding should be checked against the referenced CVE before relying on the comparison.

Fix

1. Upgrade Cursor to 2.5 or later after confirming the fixed release.
2. Inspect repository hooks before opening or executing project automation, and disable or remove hooks that are not required.

Grounding needed

acve advisory ground must confirm the affected Cursor range and whether 2.5 is the fixed release for CVE-2026-26268.

Hook inspection is a review step, not a substitute for installing the confirmed fixed Cursor release.

References

See references for primary sources.

Underlying CVEs / aliases

• CVE-2026-26268

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Upgrade Cursor to the confirmed fixed release and inspect repository hooks.

Validation

No validation entries recorded.

Grounding

• OSV: not found; checked-at 2026-09-20T02:43:28Z
• NVD: not found; checked-at 2026-09-20T02:43:28Z
• KEV: not listed in KEV; checked-at 2026-09-20T02:43:28Z

References

ADVISORY

• https://nvd.nist.gov/vuln/detail/CVE-2026-26268

REPORT

• https://example.com/research/acve

FIX

• https://github.com/pickbitsai/acve/issues?q=CVE-2026-26268