Post #3858226

So apparently Mindgard reported a trivial RCE in Cursor (if a repo opened by Cursor includes a git.exe file, that file is executed) in December 2025 (!) via HackerOne, and getting Cursor's attention required calling them out on LinkedIn. They ghosted Mindgard, prompting them to disclose. This is a 7-month window for attackers. Coordinated Disclosure is dead. Let's switch back to FD. Who owns securityfocus.com these days? https://mindgard.ai/blog/cursor-0day-when-full-disclosure-becomes-the-only-protection-left