An attacker can create a malicious repository containing a git.exe in the project root, and Cursor executes it automatically.