Critical RCE Flaw in VS Code & Cursor Fixed: Update Now!

A serious one-click vulnerability has been found in Cursor, Microsoft Visual Studio Code, and Google Antigravity. This flaw allows attackers to execute arbitrary code. Attackers can hide malicious commands in links embedded in commit messages. If a developer clicks one of these links, the editor executes the code locally without any warnings. This is concerning because developer environments hold valuable assets like source code and cloud credentials. Exploitation could give attackers terminal-level privileges, allowing them to steal API keys, scan file systems, delete files, or install malware. The attack relies on malicious links in commit messages, which developers often trust. The vulnerability eliminates a crucial user safeguard, making social engineering easier. AISLE discovered the issue and reported it to Microsoft, Cursor, and Google. All three companies have since fixed the flaw. Organizations and developers should update Cursor, VS Code, and Google Antigravity to their latest versions immediately. This highlights increasing security risks with AI-powered development tools.