CVE-2026-26268 let prompt injection escape the Cursor IDE sandbox via unprotected git hooks
CVE-2026-26268 is a high-severity sandbox escape vulnerability in Cursor IDE versions prior to 2.5, discovered by Novee Security and disclosed via a GitHub advisory on February 13, 2026. A prompt-injected AI agent could write to improperly protected .git settings including git hooks, enabling out-of-sandbox remote code execution when those hooks were automatically triggered by Git operations. The vulnerability was one of three Cursor IDE CVEs (alongside CVE-2026-22708 and CVE-2026-21523) that collectively formed a triple CVE chain targeting AI coding assistants.
An AI agent that can write to .git hooks and then trigger them through routine git operations turns prompt injection into remote code execution with no user in the loop.
Key facts
- What
- CVE-2026-26268 is a high-severity sandbox escape vulnerability in Cursor IDE versions prior to 2.5, discovered by Novee Security and disclosed via a GitHub advisory on February 13, 2026.
- Incident date
- Jan 1, 2026
- Who
- Cursor
- Failure mode
- Prompt Injection
- AI surface
- Code Assistant
- Severity
- High
What happened
CVE-2026-26268 affected all Cursor IDE versions prior to 2.5 by allowing a prompt-injected AI agent to write to unprotected .git configuration files including git hooks, which then executed arbitrary code when automatically triggered by routine git operations such as checkout or commit. An attacker could embed a malicious pre-commit hook inside a bare repository within a seemingly legitimate project, and Cursor's AI agent would autonomously execute git commands that triggered the hook without warning or user approval. The vulnerability was patched in Cursor version 2.5 and publicly disclosed as CVE-2026-26268 on February 13, 2026, with a CVSS score of 8.0. It formed one link in a triple CVE chain alongside CVE-2026-22708 (shell built-in bypass) and CVE-2026-21523 (TOCTOU race condition), all targeting the Cursor IDE attack surface.
What broke inside the model
- 01 · TriggerThe model reads retrieved or user-supplied text.
- 02 · Model stepThat text carries hidden instructions.
- 03 · Control gapNothing separates untrusted data from trusted commands.
- 04 · FailureThe injected instruction overrides the operator's.
- 05 · ConsequenceThe system acts on an outsider's intent.
At the injection point, retrieved text overrides the operator's instruction.
Cursor's sandbox failed to restrict the AI coding agent from writing to .git configuration directories, including the hooks subdirectory, which should have been treated as a protected boundary. When the agent autonomously performed git operations in response to user prompts, it unknowingly triggered malicious hooks that Git executes automatically with no user consent or warning. The system lacked guardrails to prevent the agent from modifying git internals that enable code execution outside the sandbox.
What it cost
Sources
- PrimarySandbox escape via Git hooks (GHSA-8pcm-8jpx-hv8r)github.com
- PressCursor AI IDE Vulnerability Allows Code Execution Via Hidden Git Hookshackread.com
- PrimaryCVE-2026-26268: How an AI Coding Agent Can Run Exploits in Cursor IDEnovee.security
Cite this entry
https://failureindex.ai/failures/cve-2026-26268-let-prompt-injectionAI Failure Index. "CVE-2026-26268 let prompt injection escape the Cursor IDE sandbox via unprotected git hooks" (FI-0175). Realm Labs. https://failureindex.ai/failures/cve-2026-26268-let-prompt-injection (indexed Jun 4, 2026).Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0175. Full dataset at /data.
Note from Realm Labs, the Index steward
How Realm would have caught this
- Prism
- OmniGuard
Realm inspects the model's internal state for the signature of instructions arriving through the data channel, so an injected command can be flagged and blocked inline before the model acts on it, instead of trusting a classifier that scores the input as safe.