What is the CVSS score of CVE-2026-26268?

CVE-2026-26268 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of AI / ML are affected by CVE-2026-26268?

Cursor, a popular AI-assisted code editor, contains a critical sandbox escape vulnerability (CVE-2026-26268) that allows attackers to bypass security controls by manipulating Git configuration files.

How to fix or mitigate CVE-2026-26268?

Within 24 hours: Inventory all Cursor installations and identify affected versions prior to 2.5; communicate vulnerability to development teams and restrict Cursor usage to non-sensitive projects if possible. Within 7 days: Upgrade all instances to Cursor version 2.5 or later when available; conduct code repository audits for unauthorized .git modifications. Within 30 days: Implement endpoint detection and response (EDR) monitoring for suspicious Git configuration changes; review development team access logs and implement code review checkpoints for any changes made during the vulnerability window.

AI / ML CVE-2026-26268

HIGH

Missing Authorization (CWE-862)

2026-02-13 security-advisories@github.com

RCE AI / ML Cursor

8.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.0 HIGH

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 13, 2026 - 17:16 nvd

HIGH 8.0

DescriptionGitHub Advisory

Cursor is a code editor built for programming with AI. Sandbox escape via writing .git configuration was possible in versions prior to 2.5. A malicious agent (ie prompt injection) could write to improperly protected .git settings, including git hooks, which may cause out-of-sandbox RCE next time they are triggered. No user interaction was required as Git executes these commands automatically. Fixed in version 2.5.

AnalysisAI

Cursor versions before 2.5 allow sandbox escape through improper .git configuration file protections, enabling malicious prompts or agents to write git hooks that execute arbitrary code when git commands are triggered. An attacker can achieve remote code execution without user interaction since git automatically executes these hooks, potentially compromising systems where Cursor is used for AI-assisted development. A patch is available in version 2.5.

Technical ContextAI

Classified as CWE-862 (Missing Authorization). Affects Cursor. Cursor is a code editor built for programming with AI. Sandbox escape via writing .git configuration was possible in versions prior to 2.5. A malicious agent (ie prompt injection) could write to improperly protected .git settings, including git hooks, which may cause out-of-sandbox RCE next time they are triggered. No user interaction was required as Git executes these commands automatically. Fixed in version 2.5.