{"vulnerability": "CVE-2026-26268", "sightings": [{"uuid": "4b8f603d-25da-4161-adc3-1b3a64ef684d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-26268", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mer3ai5fiw23", "content": "", "creation_timestamp": "2026-02-13T17:54:45.764864Z"}, {"uuid": "a0bac86c-f923-49ef-85aa-6ebdeeeff86e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-26268", "type": "seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3mkmztuqow32z", "content": "Vulnerability in Cursor IDE (CVE-2026-26268) #appsec", "creation_timestamp": "2026-04-29T11:50:19.396612Z"}, {"uuid": "e3ee5d86-5c29-4c2d-af3e-38095a7e8b85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-26268", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mkoskeky7c2g", "content": "Cursor AI IDE vulnerability allows code execution via hidden Git hooks\n\nNovee researchers find high-severity CVE-2026-26268 flaw in Cursor AI, allowing hackers to run malicious code when developers clone repositories.\n#cursor #hackernews #news", "creation_timestamp": "2026-04-30T04:45:12.972028Z"}, {"uuid": "fb944dec-361a-4f91-b071-55c96bcd3093", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-26268", "type": "seen", "source": "https://bsky.app/profile/mel-echosphere.bsky.social/post/3mkppekyzlz2l", "content": "Cursor \u306e Git integration\u3001CVE-2026-26268 (CVSS 9.9)\u3002\n\nprompt injection \u3067 .git/config \u3092\u66f8\u304d\u63db\u3048\u3066\u30d5\u30c3\u30af\u3092\u4ed5\u8fbc\u3080\u3002\u6b21\u306e git pull/commit \u304c trigger \u3067\u4efb\u610f\u30b3\u30fc\u30c9\u5b9f\u884c\u2014\u2014v2.5 \u672a\u6e80\u304c\u5bfe\u8c61\u3002\ud83d\udd4a\ufe0f\n\nhttps://www.csoonline.com/article/4164250/critical-cursor-bug-could-turn-routine-git-into-rce.html", "creation_timestamp": "2026-04-30T13:20:48.125439Z"}, {"uuid": "78fea0f3-56c6-4fb6-9a80-bd8fa475a686", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-26268", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mkpsj5w4c72c", "content": "Critical vulnerability CVE-2026-26268 in Cursor AI exposes developers to remote code execution via malicious repositories. Update now and enable Workspace Trust! #CyberSecurity #AI #DevSecOps Link: thedailytechfeed.com/critical-vul...", "creation_timestamp": "2026-04-30T14:17:03.390632Z"}, {"uuid": "f6076c6a-f207-443c-b35f-4b5112853f3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-26268", "type": "seen", "source": "https://bsky.app/profile/dailyqiitatrends.bsky.social/post/3ml2rkp6deb2m", "content": "\u4eca\u65e5\u306eQiita\u30c8\u30ec\u30f3\u30c9\n\n\u3010\u7dca\u6025\u3011Cursor\u306b\u300cgit clone\u300d\u3059\u308b\u3060\u3051\u3067PC\u304c\u4e57\u3063\u53d6\u3089\u308c\u308b\u8106\u5f31\u6027\uff01CVSS 9.9\u306e\u30e4\u30d0\u3059\u304e\u308b\u653b\u6483\u624b\u6cd5\nCursor\u306e\u30d0\u30fc\u30b8\u30e7\u30f32.4\u4ee5\u524d\u306b\u3001\u30ea\u30dd\u30b8\u30c8\u30ea\u3092\u30af\u30ed\u30fc\u30f3\u3059\u308b\u3060\u3051\u3067PC\u304c\u4e57\u3063\u53d6\u3089\u308c\u308b\u81f4\u547d\u7684\u306a\u8106\u5f31\u6027\uff08CVE-2026-26268\uff09\u304c\u767a\u898b\u3055\u308c\u307e\u3057\u305f\u3002\nAI\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8\u304c\u81ea\u5f8b\u7684\u306bGit\u64cd\u4f5c\u3092\u884c\u3046\u4ed5\u7d44\u307f\u304c\u60aa\u7528\u3055\u308c\u308b\u305f\u3081\u3001CVSS 9.9\u3068\u3044\u3046\u975e\u5e38\u306b\u9ad8\u3044\u5371\u967a\u5ea6\u3068\u306a\u3063\u3066\u3044\u307e\u3059\u3002\n\u5bfe\u7b56\u3068\u3057\u3066\u3001\u76f4\u3061\u306b\u30d0\u30fc\u30b8\u30e7\u30f32.5\u4ee5\u4e0a\u306b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3057\u3066\u304f\u3060\u3055\u3044\u3002\n\u3042\u308f\u305b\u3066\u3001\u4fe1\u983c\u3067\u304d\u306a\u3044\u30ea\u30dd\u30b8\u30c8\u30ea\u306e\u30af\u30ed\u30fc\u30f3\u3092\u63a7\u3048\u308b\u306a\u3069\u306e\u6ce8\u610f\u304c\u63a8\u5968\u3055\u308c\u3066\u3044\u307e\u3059\u3002\n", "creation_timestamp": "2026-05-04T22:59:18.054454Z"}, {"uuid": "c86a9636-ae27-418b-bb9a-2cbf638d9b9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-26268", "type": "seen", "source": "Telegram/yfj8_Wf1r81ZM9XH5mmBYiYd4G1zdIl6xbgawa_XXGScCdQ", "content": "", "creation_timestamp": "2026-05-05T21:00:04.000000Z"}, {"uuid": "d7d3b202-c01b-43b6-a225-bd35491c2337", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-26268", "type": "seen", "source": "https://bsky.app/profile/armor-1.bsky.social/post/3mliaz6p77c27", "content": "CVE-2026-26268: Cursor RCE via hidden Git hooks. CVSS 8.1. Opening a prepared repo runs code in your session, no prompt injection needed. Fixed in Cursor 2.5.", "creation_timestamp": "2026-05-10T07:40:26.947038Z"}, {"uuid": "ee320ce1-e88b-4002-9093-30fe7baa302e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-26268", "type": "seen", "source": "https://bsky.app/profile/crustytldr.bsky.social/post/3mliivhn7to2g", "content": "\ud83d\udd12 Cursor CVE-2026-26268: Hidden Git hooks RCE via agents autonomous Git operations\n\nA critical remote code execution (RCE) vulnerability, CVE-2026-26268, affects ...\n\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-26268 #CyberSecurity #InfoSec #CrustyTLDR", "creation_timestamp": "2026-05-10T10:01:32.344688Z"}, {"uuid": "d9ee47cf-9c98-4dcc-ac11-12578a53ceef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-26268", "type": "seen", "source": "https://t.me/GithubRedTeam/84997", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a agentic-ioc-scanner\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a dhawaldesai\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-20 11:00:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nIOC scanner for agentic AI coding tools \u2014 detects Mini Shai-Hulud, Gemini CLI RCE, Cursor CVE-2026-26268, and DPRK PromptMink.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-20T11:02:25.000000Z"}, {"uuid": "08fd7152-abb5-4ff2-811c-8833def1d093", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-26268", "type": "seen", "source": "https://bsky.app/profile/aksharma98.bsky.social/post/3mtkwnlubwc2y", "content": "Cursor shipped a zero-click RCE (CVE-2026-26268) \u2014 clone a malicious repo and the AI agent runs attacker code via Git hooks, no clicks needed.\n\nSame month: AWS Kiro rewrote its own MCP config from hidden webpage text.\n\nYour IDE is now an attack surface nobody threat-modeled.", "creation_timestamp": "2026-08-21T04:34:34.625975Z"}, {"uuid": "6b80aec7-cbf2-476e-b777-7607e9fbadce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-26268", "type": "seen", "source": "https://gist.github.com/AfvanJaffer/8b427775455df5679cc487a0f92dc1b9", "content": "#!/bin/bash\n#\n# Checks whether this machine shows any artifact of having been targeted\n# by the disclosed Cursor IDE CVEs discussed in this investigation:\n#\n#   CVE-2025-54136  \"MCPoison\"   -- MCP config trust bypass\n#   CVE-2026-26268                -- sandbox escape via .git/hooks\n#   CVE-2026-22708                -- shell environment poisoning (prompt injection)\n#   CVE-2026-50548 / CVE-2026-50549  \"DuneSlide\" -- sandbox escape via prompt injection\n#   CVE-2026-63093                -- Windows-only git.exe binary planting (N/A on macOS,\n#                                     checked anyway as a trivial negative-confirmation)\n#\n# IMPORTANT, read before trusting the output:\n#   - CVE-2026-26268 (git hooks) and CVE-2025-54136 (MCP config history) leave\n#     STATIC, verifiable artifacts on disk -- those checks are strong evidence.\n#   - CVE-2026-22708 and DuneSlide are prompt-injection-driven behavioral\n#     exploits with no documented static signature. Those checks are\n#     BEST-EFFORT / LOW-CONFIDENCE: they look for exec-event and local-storage\n#     traces, but absence of a hit here does NOT prove the machine was never\n#     hit, only that no evidence of it was found by these particular queries.\n#   - All captured text is masked before being written to disk (see\n#     mask_secrets()).\n#   - Read-only / non-destructive.\n#\n# Usage:\n#   chmod 700 ./cursor_cve_exposure_check.sh\n#   sudo /bin/bash ./cursor_cve_exposure_check.sh [lookback_days] [trusted_org_pattern]\n#\n#   lookback_days defaults to 60. trusted_org_pattern defaults to \"fastfishio\"\n#   (case-insensitive substring match against git remote URLs) -- change it\n#   if your actual GitHub org differs; anything NOT matching is flagged for\n#   manual review, not assumed malicious.\n\nset -u\numask 077\n\nif [[ \"$EUID\" -ne 0 ]]; then\n    echo \"ERROR: Run using sudo (sudo /bin/bash ./cursor_cve_exposure_check.sh).\"\n    exit 1\nfi\n\nLOOKBACK_DAYS=\"${1:-60}\"\nTRUSTED_ORG=\"${2:-fastfishio}\"\n\nHOSTNAME_NOW=\"$(/usr/sbin/scutil --get ComputerName 2>/dev/null || /bin/hostname)\"\nSAFE_HOST=\"$(printf '%s' \"$HOSTNAME_NOW\" | /usr/bin/tr ' /:' '___' | /usr/bin/tr -cd '[:alnum:]_.-')\"\nSTARTSTAMP=\"$(/bin/date '+%Y%m%d_%H%M%S')\"\n\nOUT=\"$(/bin/pwd -P)/cursor_cve_check_${SAFE_HOST}_${STARTSTAMP}\"\n\n/bin/mkdir -p \\\n    \"$OUT/00_SUMMARY\" \\\n    \"$OUT/01_VERSION_CHECK\" \\\n    \"$OUT/02_GIT_HOOKS_CVE-2026-26268\" \\\n    \"$OUT/03_MCP_HISTORY_CVE-2025-54136\" \\\n    \"$OUT/04_BEHAVIORAL_CVE-2026-22708_DuneSlide\" \\\n    \"$OUT/05_WINDOWS_ONLY_CVE-2026-63093\" \\\n    \"$OUT/06_UNTRUSTED_REPO_REMOTES\"\n\ntimestamp() { /bin/date '+%Y-%m-%d %H:%M:%S %z'; }\nlog() { echo \"[$(timestamp)] $*\"; }\n\nmask_secrets()\n{\n    /usr/bin/sed -E \\\n        -e 's/(gh[pousr]_)[A-Za-z0-9]{16,}/\\1***REDACTED***/g' \\\n        -e 's/(github_pat_)[A-Za-z0-9_]{16,}/\\1***REDACTED***/g' \\\n        -e 's#(https?://)[^/@[:space:]]+:[^/@[:space:]]+@#\\1***REDACTED-BASICAUTH***@#g' \\\n        -e 's/([Oo][Aa][Uu][Tt][Hh][_-]?[Tt][Oo][Kk][Ee][Nn][[:space:]]*[:=][[:space:]]*)[^[:space:]\"'\"'\"']+/\\1***REDACTED***/g' \\\n        -e 's/(\"?[Aa][Pp][Ii][_-]?[Kk][Ee][Yy]\"?[[:space:]]*[:=][[:space:]]*)[^[:space:],}]+/\\1***REDACTED***/g' \\\n        -e 's/([Pp]assword[[:space:]]*[:=][[:space:]]*)[^[:space:]\"'\"'\"']+/\\1***REDACTED***/g'\n}\n\ncapture_shell()\n{\n    local label=\"$1\" outfile=\"$2\" cmd=\"$3\"\n    { echo \"### $label\"; echo \"### shell: $cmd\"; echo \"### captured: $(timestamp)\"; echo; /bin/bash -c \"$cmd\" 2>&1; } \\\n        | mask_secrets > \"$outfile\"\n}\n\n###############################################################################\n# 01 - VERSION CHECK (informational -- cross-reference against known fix table)\n###############################################################################\n\nlog \"Checking installed Cursor version(s)...\"\n\n{\n    echo \"# Known fix versions for the CVEs this script checks for:\"\n    echo \"#   CVE-2025-54136 (MCPoison)            fixed in 1.3\"\n    echo \"#   CVE-2026-26268  (git hooks escape)     fixed in 2.5\"\n    echo \"#   CVE-2026-22708  (shell env poisoning)  fixed in 2.3\"\n    echo \"#   CVE-2026-50548/-50549 (DuneSlide)      fixed in 3.0\"\n    echo \"#   CVE-2026-63093  (Windows git.exe)      Windows-only, N/A here\"\n    echo \"# A version at/above the fix version means the CURRENT binary is\"\n    echo \"# not exploitable via that bug -- it says nothing about whether\"\n    echo \"# an attack happened while running an OLDER, vulnerable version\"\n    echo \"# before an update was applied. That's what the checks below are for.\"\n    echo\n    if [[ -f \"/Applications/Cursor.app/Contents/Resources/app/product.json\" ]]; then\n        /usr/bin/python3 -c \"\nimport json\nd = json.load(open('/Applications/Cursor.app/Contents/Resources/app/product.json'))\nprint('Installed version:', d.get('version'))\n\"\n    else\n        echo \"Cursor.app not found at the standard path.\"\n    fi\n} > \"$OUT/01_VERSION_CHECK/version.txt\"\n\n###############################################################################\n# 02 - CVE-2026-26268: malicious .git/hooks (strong evidence if present)\n###############################################################################\n\nlog \"Scanning every git repo for non-default, active git hooks...\"\n\nHOOKS_OUT=\"$OUT/02_GIT_HOOKS_CVE-2026-26268/findings.txt\"\n{\n    echo \"# Git ships hook files ending in .sample which are inactive by\"\n    echo \"# default. Any file here WITHOUT .sample is an ACTIVE hook that\"\n    echo \"# git will execute automatically at the relevant lifecycle point\"\n    echo \"# (pre-commit, post-checkout, post-merge, pre-push, etc).\"\n    echo \"# Custom hooks are rare in normal repos -- treat every hit below\"\n    echo \"# as worth reading in full.\"\n    echo\n} > \"$HOOKS_OUT\"\n\nwhile IFS= read -r -d '' HOOKDIR; do\n    for HOOK in \"$HOOKDIR\"/*; do\n        [[ -f \"$HOOK\" ]] || continue\n        [[ \"$HOOK\" == *.sample ]] && continue\n        {\n            echo \"==== ACTIVE HOOK: $HOOK ====\"\n            /usr/bin/stat -f '  modified: %Sm   accessed: %Sa   executable: %Sp' \"$HOOK\" 2>&1\n            REPO_DIR=\"$(/usr/bin/dirname \"$(/usr/bin/dirname \"$HOOKDIR\")\")\"\n            echo \"  repo: $REPO_DIR\"\n            echo \"  -- content --\"\n            /bin/cat \"$HOOK\" 2>&1\n            echo\n        } >> \"$HOOKS_OUT\"\n    done\ndone < <(/usr/bin/find /Users -maxdepth 9 -type d -path '*/.git/hooks' -not -path '*/node_modules/*' -print0 2>/dev/null)\n\nif ! /usr/bin/grep -q '^==== ACTIVE HOOK' \"$HOOKS_OUT\"; then\n    echo \"No active (non-.sample) git hooks found in any repo under /Users.\" >> \"$HOOKS_OUT\"\nfi\n\n###############################################################################\n# 03 - CVE-2025-54136 (MCPoison): mcp.json modification history\n###############################################################################\n\nlog \"Checking mcp.json files inside git repos for post-approval tampering...\"\n\nMCP_OUT=\"$OUT/03_MCP_HISTORY_CVE-2025-54136/findings.txt\"\n{\n    echo \"# The MCPoison attack requires a repo-committed mcp.json to be\"\n    echo \"# modified AFTER the developer already approved it once in Cursor.\"\n    echo \"# More than one commit touching the same mcp.json is not proof of\"\n    echo \"# attack (legitimate config changes happen), but is the exact\"\n    echo \"# pattern to manually review, especially whitespace-only diffs.\"\n    echo\n} > \"$MCP_OUT\"\n\nwhile IFS= read -r -d '' MCPFILE; do\n    REPO_DIR=\"$(/usr/bin/git -C \"$(/usr/bin/dirname \"$MCPFILE\")\" rev-parse --show-toplevel 2>/dev/null)\"\n    [[ -z \"$REPO_DIR\" ]] && continue\n    RELPATH=\"${MCPFILE#$REPO_DIR/}\"\n\n    {\n        echo \"==== $MCPFILE ====\"\n        echo \"  repo: $REPO_DIR\"\n        echo \"  -- commit history for this file --\"\n        /usr/bin/git -C \"$REPO_DIR\" log --follow --oneline -- \"$RELPATH\" 2>&1\n        COMMIT_COUNT=\"$(/usr/bin/git -C \"$REPO_DIR\" log --follow --oneline -- \"$RELPATH\" 2>/dev/null | /usr/bin/wc -l | /usr/bin/tr -d ' ')\"\n        echo \"  commit count touching this file: $COMMIT_COUNT\"\n        if [[ \"${COMMIT_COUNT:-0}\" -gt 1 ]]; then\n            echo \"  -- full diff history (review for post-approval command changes) --\"\n            /usr/bin/git -C \"$REPO_DIR\" log --follow -p -- \"$RELPATH\" 2>&1 | /usr/bin/head -300\n        fi\n        echo\n    } >> \"$MCP_OUT\"\ndone < <(/usr/bin/find /Users -maxdepth 8 -type f -iname 'mcp.json' -not -path '*/node_modules/*' -not -path '*/.vscode/extensions/*' -not -path '*/.cursor/extensions/*' -print0 2>/dev/null)\n\nif ! /usr/bin/grep -q '^====' \"$MCP_OUT\"; then\n    echo \"No git-tracked mcp.json files found under /Users.\" >> \"$MCP_OUT\"\nfi\n\n###############################################################################\n# 04 - CVE-2026-22708 / DuneSlide: behavioral traces (best-effort, weak signal)\n###############################################################################\n\nlog \"Best-effort scan for Cursor-spawned shell activity in unified log (last ${LOOKBACK_DAYS}d)...\"\n\ncapture_shell \"Unified log: exec-like events tied to Cursor/Cursor Helper processes\" \\\n    \"$OUT/04_BEHAVIORAL_CVE-2026-22708_DuneSlide/exec_events.txt\" \\\n    \"/usr/bin/log show --last ${LOOKBACK_DAYS}d --predicate '(process CONTAINS[c] \\\"Cursor\\\") AND (eventMessage CONTAINS[c] \\\"bash\\\" OR eventMessage CONTAINS[c] \\\"/bin/sh\\\" OR eventMessage CONTAINS[c] \\\"osascript\\\" OR eventMessage CONTAINS[c] \\\"curl\\\" OR eventMessage CONTAINS[c] \\\"child_process\\\")' --style compact 2>&1 | /usr/bin/head -5000\"\n\nlog \"Best-effort sweep of Cursor's local storage for suspicious command strings (noisy, low confidence)...\"\n\ncapture_shell \"Strings sweep of Cursor SQLite state stores for shell/exfil-looking patterns\" \\\n    \"$OUT/04_BEHAVIORAL_CVE-2026-22708_DuneSlide/local_storage_strings.txt\" \\\n    \"/usr/bin/find /Users/*/Library/'Application Support'/Cursor -maxdepth 6 -type f \\\\( -iname '*.vscdb' -o -iname '*.json' \\\\) -size -20M 2>/dev/null | while read -r f; do /usr/bin/strings \\\"\\$f\\\" 2>/dev/null | /usr/bin/grep -iE 'curl .*(-d|-F|-T)|base64 -d|/dev/tcp/|nc -e|reverse.?shell|wget .*\\\\|.*sh' | /usr/bin/sed \\\"s|^|[\\$f] |\\\"; done\"\n\n###############################################################################\n# 05 - CVE-2026-63093: Windows-only, trivial negative confirmation\n###############################################################################\n\nlog \"Confirming no Windows git.exe-style binary planting artifacts exist (N/A platform, sanity check only)...\"\n\ncapture_shell \"Search for any git.exe-named file anywhere under /Users (expected: none, this is macOS)\" \\\n    \"$OUT/05_WINDOWS_ONLY_CVE-2026-63093/check.txt\" \\\n    \"/usr/bin/find /Users -iname 'git.exe' 2>/dev/null || true\"\n\n###############################################################################\n# 06 - Cross-cutting: repos cloned from remotes outside the trusted org\n###############################################################################\n\nlog \"Listing git remotes outside the trusted org pattern '${TRUSTED_ORG}' (every CVE above requires a malicious/untrusted repo as the delivery vector)...\"\n\ncapture_shell \"Git remote URLs not matching '${TRUSTED_ORG}' -- review each manually\" \\\n    \"$OUT/06_UNTRUSTED_REPO_REMOTES/findings.txt\" \\\n    \"/usr/bin/find /Users -maxdepth 8 -type d -name .git -not -path '*/node_modules/*' -print0 2>/dev/null | while IFS= read -r -d '' g; do repo=\\$(/usr/bin/dirname \\\"\\$g\\\"); remotes=\\$(/usr/bin/git --git-dir=\\\"\\$g\\\" remote -v 2>/dev/null); echo \\\"\\$remotes\\\" | /usr/bin/grep -viq '${TRUSTED_ORG}' && [[ -n \\\"\\$remotes\\\" ]] && { echo \\\"== \\$repo ==\\\"; echo \\\"\\$remotes\\\"; echo; }; done\"\n\necho\necho \"====================================================================\"\necho \"CHECK COMPLETE\"\necho \"Output: $OUT\"\necho \"====================================================================\"\necho\necho \"Confidence summary:\"\necho \" - 02 (git hooks / CVE-2026-26268):        STRONG -- static artifact,\"\necho \"   any hit here needs immediate manual review.\"\necho \" - 03 (mcp.json history / CVE-2025-54136): STRONG -- static artifact,\"\necho \"   review any file with commit count > 1.\"\necho \" - 04 (CVE-2026-22708 / DuneSlide):        WEAK/BEST-EFFORT -- these\"\necho \"   are prompt-injection-driven behavioral exploits with no documented\"\necho \"   static signature. An empty result here does not clear the machine,\"\necho \"   it only means these specific queries found nothing.\"\necho \" - 05 (CVE-2026-63093):                    N/A on macOS, included for\"\necho \"   completeness only.\"\necho \" - 06 (untrusted remotes):                 every CVE above needs a\"\necho \"   malicious repo as the delivery vector -- anything flagged here is\"\necho \"   where you'd look for the actual injection point.\"\necho\necho \"Before sharing $OUT, spot-check a few files yourself to confirm\"\necho \"the redaction caught everything you'd consider sensitive.\"\n", "creation_timestamp": "2026-08-26T08:54:54.108122Z"}]}