CVE-2026-26268

CVE-2026-26268 turns the act of cloning a Git repository in Cursor into automatic remote code execution. No file needs to be opened. No prompt needs to be accepted. The tool building the AI-first web is itself a one-step compromise vector — and every line of code it produces in a compromised session is suspect.