A newly discovered vulnerability in Windows allows malicious actors to trigger code execution on compromised systems through cloned repositories on GitHub, with researchers warning that even novice attackers can exploit this flaw. The issue, known as “Cursor,” affects users who rely on GitHub’s Package Manager for Windows (NuGet) and have their NuGet package cache configured to allow unsigned packages.
The vulnerability works by allowing an attacker to create a malicious cloned repository on GitHub, which contains a specially crafted package. When the victim installs this package using NuGet, the package’s installer code is executed, giving the attacker access to the compromised system. This can be done with ease, even for those without extensive technical expertise. The only requirement for exploitation is that the victim has a cloned repository on their system, which is a common practice among developers.
One of the worrying aspects of this vulnerability is its potential for mass exploitation. Because it relies on cloned repositories, an attacker could target multiple users at once by creating malicious packages and sharing them through the GitHub platform. This would allow the attacker to compromise numerous systems in a short period, making the “Cursor” vulnerability particularly concerning.
Researchers have confirmed that they were able to exploit this flaw using both automated tools and manual testing. The ease with which this was done highlights the need for developers to take immediate action to protect their NuGet package cache configurations. A patch is reportedly being developed by Microsoft, but in the meantime, users are advised to disable unsigned packages or modify their NuGet configuration to only allow signed packages.
As AI-powered threat modeling tools become increasingly prevalent in cybersecurity, it’s clear that human attackers are finding ways to adapt and exploit these new vulnerabilities. The “Cursor” issue serves as a stark reminder of the importance of robust security measures and regular updates. Developers should take note of this vulnerability and ensure their systems are properly secured against similar threats.
For users who have not yet taken steps to secure their NuGet package cache configurations, it’s essential to act quickly to prevent potential exploitation. Microsoft advises disabling unsigned packages until a patch is released, which can be done by modifying the NuGet configuration file or using the built-in Package Manager for Windows (NuGet) settings.
Source: The Hacker News — 2026-07-15