Cursor Git automation possibly fork-bombing my system

Making a code change involving the string yes seems to have kicked off several normally innocuous commands like

/bin/sh -c for hash in $(git rev-parse --disambiguate="yes"); do git cat-file -t $hash 2>/dev/null | grep -q '^commit$' && echo $(git log -n 1 --pretty=format:'%H<|ENT|><|RY|>%s<|COM|><|MIT|>' $hash);

which constitute something like a fork-bomb under that particular invocation, which caused OOMs and other related problems on my system.

This is not a slow memory leak; it filled 10s of GiB of memory in around 5 minutes.

Snippet from ps aux during issue:

[...]
dlk       151665  0.0  0.0   7856  2064 pts/0    SN   17:13   0:00 /bin/sh -c for hash in $(git rev-parse --disambiguate="`yes`"); do git cat-file -t $hash 2>/dev/null | grep -q '^commit$' && echo $(git log -n 1 --pretty=format:'%H<|ENT|><|RY|>%s<|COM|><|MIT|>' $hash); done
dlk       151666 93.1 71.3 190666580 188239220 pts/0 RN 17:13   5:02 /bin/sh -c for hash in $(git rev-parse --disambiguate="`yes`"); do git cat-file -t $hash 2>/dev/null | grep -q '^commit$' && echo $(git log -n 1 --pretty=format:'%H<|ENT|><|RY|>%s<|COM|><|MIT|>' $hash); done
[...]

I have not attempted to directly reproduce the issue. But it has occurred twice, on different versions of Cursor, separated by a re-install and wiping as much of Cursor’s state as possible.

Version info:

Version: 0.48.7
VSCode Version: 1.96.2
Commit: 1d623c4cc1d3bb6e0fe4f1d5434b47b958b05870
Date: 2025-04-02T04:59:37.442Z
Electron: 34.3.4
Chromium: 132.0.6834.210
Node.js: 20.18.3
V8: 13.2.152.41-electron.0
OS: Linux x64 6.12.22