Cursor AI Code Editor RCE Flaw Allows Malicious Code to Autorun on Machines

Cursor AI Code Editor has been found to be vulnerable to remote code execution when developers open code repositories, with malicious code potentially running automatically and without any warning prompt. The flaw relies on a misconfiguration where Cursor ships with Workspace Trust disabled by default, allowing VS Code‑style tasks to execute instantly when a project folder is opened.

Specifically, a repository containing a malicious .vscode/tasks.json file with runOptions[.]runOn: “folderOpen” can trigger code execution as soon as the folder is accessed. Attackers could craft repositories that steal credentials, exfiltrate files, or establish remote access the moment a developer inspects the repository, broadening the risk to cloud services and automated pipelines.

Oasis Security published a full technical breakdown and working proof of concept to illustrate the threat, and the article notes that Cursor’s team says Workspace Trust can be enabled by users with updated guidance forthcoming. The advisory also recommends disabling automatic tasks by setting task[.]allowAutomaticTasks: “off” and opening unknown repositories in viewer‑only editors or disposable containers to limit damage. according to Oasis Security. 11 September 2025