Cursor AI Code Editor Flaw Enables Silent Code Execution via Malicious Repositories

The Hacker News reports a disclosed security weakness in Cursor, an AI-powered code editor, that could trigger silent code execution when a maliciously crafted repository is opened. The flaw arises because Workspace Trust is disabled by default, allowing VS Code-style tasks configured with runOptions[.]runOn: 'folderOpen' to auto-execute as developers browse a project. A malicious .vscode/tasks.json can turn a simple folder open into code execution in the user’s context, according to Oasis Security.

Cursor is a fork of Visual Studio Code that supports Workspace Trust to let developers safely browse code regardless of origin, and with the option off, an attacker can host a booby-trapped project on GitHub or another platform to deliver hidden autorun instructions. The piece advises users to enable Workspace Trust in Cursor, to open untrusted repositories in a different editor, and to audit them before opening them in Cursor. The article also notes ongoing discussions around prompt injections and pushes for broader supply chain security in AI-enabled development.