RCE Vulnerability in AI Code Editors Cursor, VS Code and Google Antigravity Threatens 50 Million Developers
Researchers at AISLE have disclosed a critical remote code execution vulnerability that affected the popular AI code editors Cursor, Microsoft Visual Studio Code and Google Antigravity. The flaw enabled an attacker to execute arbitrary code on a developer’s machine simply by embedding a malicious link inside a Git commit message. Approximately 50 million users were potentially at risk before patches were issued by all three vendors.
How the attack worked
The exploitation scenario closely mirrored normal development workflows. An attacker only needed to place a crafted link in a commit message. When a developer viewed the commit history inside the IDE and clicked the link, arbitrary code executed with the privileges of the current user. No pop-ups, confirmation dialogs or other indicators appeared during execution.
Successful exploitation allowed an attacker to:
- Steal API keys for services such as OpenAI, Anthropic and Stripe
- Install persistent malware that survived editor restarts
- Read or delete files on the local filesystem
- Run any commands under the logged-in user account
Why multiple editors were affected
Cursor was built as a fork of Visual Studio Code and inherited its architecture. The same underlying issue was later found in Google Antigravity, which also relies on VS Code components. This demonstrates the “shared component vulnerability” effect: when many AI tools reuse the same foundation, a single architectural flaw can propagate across multiple widely used products.
Why developers are high-value targets
Developer workstations typically contain corporate Git repositories, API and SSH keys, Kubernetes credentials and environment secrets. Compromising one machine often provides an initial foothold into broader corporate infrastructure. AI editors increase this risk by concentrating even more sensitive data and automation capabilities in a single environment.
Practical recommendations
Organizations using the affected editors should:
- Update to the latest patched versions immediately
- Scan developer workstations for suspicious activity
- Rotate any API keys, tokens or credentials that may have been stored locally
- Treat repository contents, including commit messages, as potentially untrusted
- Review AI-generated code and actions with heightened scrutiny
Related articles
Cisco Issues Emergency Patches for Critical ISE Zero-Day CVE-2026-76460 Already Exploited in Attacks
Cisco has released emergency patches for Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) to address CVE-2026-76460, a maximum-severity zero-day with a CVSS score of 10.0. The vulnerability stems from insufficient authentication controls in an API endpoint, allowing remote attackers to bypass authentication entirely without credentials. Active exploitation has been confirmed, enabling unauthorized access to the API gateway and potential root-level command execution when chained with further actions. The flaw affects all configurations of ISE and ISE-PIC, with no available workarounds, forcing organizations to apply updates immediately. Patches are available for branches 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4, while version 3.0 has reached end of software maintenance. Administrators are advised to review ise-kong access.log and node access logs for suspicious usernames and cross-reference with perimeter and firewall logs. In cases of confirmed compromise, affected nodes should be reinstalled and restored from backups, with iACLs recommended to restrict management traffic during rollout.
Stored XSS in Telegram Desktop Allows Silent Data Exfiltration via Chat Export
Researchers at ExPatch Vulnerability Research discovered a stored XSS vulnerability in Telegram Desktop that could be triggered when users exported chat history to HTML. The flaw resided in export_output_html.cpp where button text from inline keyboards was not passed through the SerializeString function, allowing arbitrary HTML and JavaScript to execute upon opening the exported file. Attackers could deliver the payload through a bot that never joined the target group, relying on message forwarding to reach victims. Once executed, the script exfiltrated all visible messages, chat metadata, and file paths to an attacker-controlled server while optionally replacing the page with a phishing form. Telegram issued a silent fix in Beta v6.9.4 and Stable v7.0.1 without publishing an advisory or assigning a CVE. The researchers refused the offered bounty and published the details after the patch to inform users about risks from previously exported files.
Cisco Confirms Active Exploitation of Critical Secure Email Gateway Flaw Allowing Root Command Execution
Cisco has confirmed active exploitation of a critical vulnerability in its Secure Email Gateway product that allows attackers to execute arbitrary commands with root privileges. The flaw, tracked as CVE-2026-76461 with a CVSS score of 9.8, stems from insufficient input validation in the message analysis logic of AsyncOS. Attackers can trigger the issue by sending a specially crafted email containing malicious SQL instructions, which leads to arbitrary SQL command execution and full root access on affected appliances. The vulnerability impacts physical and virtual deployments running AsyncOS versions 15.5 and earlier, 16.0, and 16.5. Patches are available in versions 15.5.5-0141, 16.0.4-302, and 16.5.0-780, while the Secure Email and Web Manager and Secure Web Appliance remain unaffected. CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 14 and set a September 17 remediation deadline for federal agencies.
Cisco ISE Affected by 42 Vulnerabilities Including Multiple Critical Flaws with Confirmed Exploitation
Cisco Identity Services Engine (ISE) has been found to contain 42 vulnerabilities across 15 security advisories released by Cisco Systems on September 16, 2026. Six advisories received the highest Critical rating, covering 21 individual vulnerabilities, while three were rated High and six Medium. One standout issue, CVE-2026-76460, allows attackers to bypass authentication on the management API via crafted HTTP requests and execute commands with root privileges. The flaw also impacts the Cisco ISE Passive Identity Connector (ISE-PIC). Cisco has urged immediate application of updates as some vulnerabilities are already being exploited in the wild. The product provides core network authentication and access control functions for enterprise environments.