tag: Code-Execution · 3 items
- Engineer — Plan: Four of the seven affected agents remain unpatched, making this an active exposure for any team whose developers clone untrusted repos while running AI coding assistants. Audit which agents (Claude Code, Codex CLI, Cursor, etc.) are in use, update those that have received patches, and enforce policy against running agents against repositories from untrusted sources until remaining fixes ship.
- SOC/IR — Learn: This research introduces a new attack class—git-config-triggered code execution via AI agent trust boundaries—that is worth understanding for future detection work on developer endpoints, but no IOCs, exploited campaigns, or mappable TTPs are published yet to act on immediately.
- Leader — Plan: With four tools still unpatched, any organization where developers use CLI AI coding agents carries uncontrolled supply-chain risk from malicious repository clones. This quarter, inventory which agents are deployed, confirm patched versions are standardized, and establish a policy on approved repositories before AI agent use.
- Engineer — Act: Public PoC exists for a heap overflow triggered by opening a crafted XZ archive in 7-Zip, a tool common in dev workstations and CI/CD pipelines; patch all 7-Zip installations to 26.02 and audit any automated pipeline steps that extract XZ archives unattended.
- SOC/IR — Plan: No confirmed in-the-wild exploitation yet, but the public PoC raises urgency; build a detection for anomalous child processes spawned from 7-Zip binaries (7z.exe, 7zG.exe) during extraction, prioritizing CI/CD runners and build servers where archives are processed automatically.
- Leader — Skip
- Signals: CVE-2026-14266 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: Any developer who opens an untrusted repo in Cursor on Windows is at risk of credential theft (SSH keys, cloud tokens) with no user interaction required — the attack path is fully described, making it practically exploitable now. Update Cursor to the patched version immediately; until confirmed patched, audit recently cloned project directories for unexpected git.exe files and avoid opening untrusted repos in Cursor on Windows.
- SOC/IR — Plan: No active campaign IOCs are reported, but the technique is clear: build a detection for Cursor (or any IDE process) spawning child processes from non-standard project root paths, specifically hunting git.exe executions outside of installed VCS tool directories on Windows endpoints.
- Leader — Plan: Cursor is widely adopted among developer teams; this flaw enables silent credential and source-code compromise via a simple repo-clone workflow. Circulate a developer advisory this week, confirm vendor patch availability, and consider a temporary policy restricting Cursor on Windows for repos from untrusted sources until remediated.