Loading story…
A critical one-click remote code execution flaw in Microsoft VS Code, Cursor, and Google Antigravity allowed attackers to embed a malicious link in a Git commit message and trigger arbitrary code execution when a developer clicked it inside the editor. The exploit reportedly ran with the victim’s terminal privileges and required no warning or confirmation, creating a path to silent compromise across tools used by an estimated 50 million developers.
Researchers at AISLE said they first found the issue in VS Code in fall 2025 and disclosed it to Microsoft and Cursor, then identified the same inherited weakness in Google Antigravity in early 2026 because all three products shared VS Code-derived architecture. The flaw could enable credential theft, persistent malware installation, keylogging, and file access or deletion, but Google, Microsoft, and Cursor have patched the vulnerability, and current versions are reported not to contain the issue.
See affected versions and whether adversaries are exploiting it.
7 events from the most recent confirmed update back to the earliest known activity.
AISLE later discovered the same vulnerability in Google Antigravity, which the reports describe as derived from VS Code architecture. This showed the flaw had propagated across multiple VS Code-based developer tools.
AISLE identified a critical one-click remote code execution vulnerability in Microsoft VS Code during automated vulnerability scanning. The flaw allowed arbitrary code execution when a developer clicked a malicious link embedded in a Git commit message.
Microsoft later released a fix for the VS Code vulnerability, after Google and Cursor had already remediated their affected products.
Cursor patched the inherited one-click RCE vulnerability after disclosure.
Google fixed the Google Antigravity vulnerability within days of disclosure, according to the reports.
After finding the inherited weakness in Google Antigravity, AISLE reported the issue to Google for remediation.
After identifying the vulnerability, AISLE responsibly disclosed the issue to Microsoft and Cursor. Cursor was affected because it inherited the weakness from the VS Code codebase.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed a Windows arbitrary code execution flaw in the Cursor AI coding IDE that causes the application to automatically run a malicious `git.exe` placed in the root of a repository when the project is opened. Mindgard said the issue stems from Cursor's Git path resolution logic searching the workspace itself for Git binaries, enabling attacker-controlled code to execute with the developer's privileges without clicks, prompts, or warnings; the payload may also be triggered repeatedly during normal use. In a demonstration, Mindgard renamed Windows Calculator to `git.exe` and showed Cursor launched it simply by opening the poisoned repository. Mindgard said it first reported the vulnerability to Cursor in December 2025, later resubmitted it through HackerOne after contacting the company's CISO, and that the flaw was still present in Cursor version `3.2.16` as of late April 2026 and in the latest version it tested before publication. Cursor told Dark Reading it was addressing the issue. Until a fix is available, Mindgard urged developers to open untrusted repositories only in isolated environments and recommended enterprise Windows controls such as **AppLocker** or **Windows App Control** to reduce exploitation risk.
Jul 18, 2026
Security researchers at **OX Security** disclosed multiple vulnerabilities across widely used Microsoft Visual Studio Code extensions—**Live Server**, **Code Runner**, **Markdown Preview Enhanced**, and **Microsoft Live Preview**—with combined installs reported at **125–128 million**. The issues enable attacks ranging from **local file exfiltration** to **arbitrary code/JavaScript execution**, and highlight how a single vulnerable or malicious extension can be leveraged for broader compromise and potential lateral movement in developer environments. Reported flaws include **CVE-2025-65717** (Live Server; CVSS 9.1) enabling local file theft by luring a developer to a malicious site while the extension’s local server is running (e.g., `localhost:5500`), **CVE-2025-65716** (Markdown Preview Enhanced; CVSS 8.8) allowing arbitrary JavaScript execution via a crafted `.md` file with subsequent local port enumeration and exfiltration, and **CVE-2025-65715** (Code Runner; CVSS 7.8) enabling code execution by tricking users into modifying `settings.json`. Separate reporting on **Microsoft Live Preview** describes a **one-click reflected XSS** and unauthenticated request abuse against the extension’s local development server to enumerate and exfiltrate sensitive files (e.g., `.env`, API keys, source code); this Live Preview issue was reported as patched in version **0.4.16** via input sanitization (e.g., an `escapeHTML` function), while other extension issues were described as **unpatched** at the time of reporting.
Jun 29, 2026
Security researchers at Ox Security have identified that the AI-powered code editors Windsurf and Cursor, both forks of Visual Studio Code, are running outdated versions of Electron and Chromium, exposing over 1.8 million users to at least 94 known and previously patched security vulnerabilities. These vulnerabilities include serious issues such as remote code execution and sandbox escape bugs, with a particular focus on CVE-2025-7656, an integer overflow flaw in the V8 JavaScript engine that can be exploited via malicious deep links, infected Markdown previews, or booby-trapped repositories. The researchers demonstrated successful exploitation of this flaw, showing the potential for denial-of-service and arbitrary code execution within the IDEs, which could lead to developer workstation compromise, data theft, or source code manipulation. Despite responsible disclosure of these risks, vendor responses have been inadequate. Cursor dismissed the vulnerability as "out of scope," claiming it only caused a self-inflicted crash, a stance criticized by security experts for underestimating the risk of memory corruption and more severe attacks. Windsurf has not issued any official mitigation or security advisory. The continued use of outdated Electron and Chromium components in these widely used development tools leaves a significant portion of the developer community exposed to active threats that have already been addressed in newer software versions.
Jun 29, 2026