CVE-2026-26268

CVE-2026-26268 describes a critical sandbox escape vulnerability in Cursor code editor versions prior to 2.5, allowing a malicious agent to achieve out-of-sandbox Remote Code Execution (RCE). This is achieved by writing to improperly protected .git configuration files, specifically git hooks, which are automatically executed without user interaction. With a CVSS score of 9.9, this vulnerability presents a severe risk due to its network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.