RCE Vulnerability in AI Code Editors Cursor, VS Code and Google Antigravity Threatens 50 Million Developers
Researchers at AISLE have disclosed a critical remote code execution vulnerability that affected the popular AI code editors Cursor, Microsoft Visual Studio Code and Google Antigravity. The flaw enabled an attacker to execute arbitrary code on a developer’s machine simply by embedding a malicious link inside a Git commit message. Approximately 50 million users were potentially at risk before patches were issued by all three vendors.
How the attack worked
The exploitation scenario closely mirrored normal development workflows. An attacker only needed to place a crafted link in a commit message. When a developer viewed the commit history inside the IDE and clicked the link, arbitrary code executed with the privileges of the current user. No pop-ups, confirmation dialogs or other indicators appeared during execution.
Successful exploitation allowed an attacker to:
- Steal API keys for services such as OpenAI, Anthropic and Stripe
- Install persistent malware that survived editor restarts
- Read or delete files on the local filesystem
- Run any commands under the logged-in user account
Why multiple editors were affected
Cursor was built as a fork of Visual Studio Code and inherited its architecture. The same underlying issue was later found in Google Antigravity, which also relies on VS Code components. This demonstrates the “shared component vulnerability” effect: when many AI tools reuse the same foundation, a single architectural flaw can propagate across multiple widely used products.
Why developers are high-value targets
Developer workstations typically contain corporate Git repositories, API and SSH keys, Kubernetes credentials and environment secrets. Compromising one machine often provides an initial foothold into broader corporate infrastructure. AI editors increase this risk by concentrating even more sensitive data and automation capabilities in a single environment.
Practical recommendations
Organizations using the affected editors should:
- Update to the latest patched versions immediately
- Scan developer workstations for suspicious activity
- Rotate any API keys, tokens or credentials that may have been stored locally
- Treat repository contents, including commit messages, as potentially untrusted
- Review AI-generated code and actions with heightened scrutiny
Related articles
Attackers Exploit Critical Atlassian Data Center Flaw CVE-2026-21589 Hours After PoC Release
Exploitation attempts against CVE-2026-21589 began almost immediately after technical details and a Nuclei template were published. The vulnerability allows unauthenticated arbitrary file read in multiple Atlassian Data Center products and carries a CVSS v4.0 score of 9.3. In environments integrated with Crowd, attackers who obtain crowd.properties can extract plaintext credentials and escalate to administrator privileges via the Crowd API. The flaw stems from improper handling of double-colon sequences in a shared web resource library, enabling path traversal against plugin resource endpoints. Affected products include Bitbucket Data Center, Confluence Data Center, Jira Software Data Center, Jira Service Management Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. Atlassian urges immediate patching outside normal cycles and recommends WAF rules or Tomcat RewriteValve configurations to block traversal patterns. Organizations should also review access logs for double-decoded URLs containing .., /, \, or :: sequences.
LibreOffice and Apache OpenOffice Flaw Enables Remote Code Execution via Malicious Calc Tables Without Macro Warnings
Researchers have demonstrated an attack against LibreOffice and Apache OpenOffice users that executes arbitrary Java code simply by opening a malicious spreadsheet, without requiring macro permissions or triggering any security prompts. The vulnerability requires Java support to be enabled in the office suite and exploits legitimate features in the Calc component that automatically fetch data from external database sources. When a crafted document is opened, Calc loads a linked database file that references a malicious Java driver, allowing the attacker’s code to run inside the office process. LibreOffice has already patched the issue tracked as CVE-2026-63277 with the release of versions 26.2.5 and 26.8.0 on October 5, while Apache OpenOffice remains vulnerable up to version 4.1.16 under CVE-2026-59265 with a fix expected in 4.1.17. The attack chain works on both Windows and Linux and bypasses macro protections entirely because no user consent dialog appears. Although only a proof-of-concept exploit that launches the calculator has been published so far, the same technique can execute any Java payload. Users of OpenOffice are advised to disable Java or avoid untrusted files until the patch is available.
Atlassian Fixes Critical Path Traversal Flaw CVE-2026-21589 Exposing Files in Jira and Confluence
Atlassian has patched CVE-2026-21589, a CVSS 9.3 path traversal vulnerability that allows unauthenticated attackers to read files across eight products including Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye in Data Center editions. The flaw accepts manipulated paths where traversal sequences appear adjacent to forward slashes, backslashes or double colons, including URL-encoded variants. Attackers must know the exact file name and path because the vulnerability does not permit directory listing and is restricted to the web application root directory of each product. Configuration files located in predictable locations remain accessible to attackers familiar with the products. Patches have been released in specific versions such as Bitbucket 10.5.1, Confluence 10.2.19, Jira Software and Jira Service Management 11.3.12, Bamboo 12.1.12, Crowd 7.2.4 and Crucible and Fisheye 4.9.15. Atlassian found no evidence of exploitation in its cloud products, though the advisory does not address on-premises customer installations.
Apache Struts CVE-2026-104711 Enables Remote Code Execution via Legacy RESTful Mapper
Apache Struts has patched four vulnerabilities, one of which permits unauthenticated remote code execution through an OGNL injection flaw. The issue, tracked as CVE-2026-104711, only affects applications that still rely on the legacy RESTful mapper; modern configurations using the default mapper, restful2, or the official Struts REST plugin remain unaffected. Exploitation occurs when the legacy mapper extracts action names and parameters directly from the URL, allowing attackers to inject malicious OGNL expressions. Vulnerable releases span 2.0.0–2.3.37, 2.5.0–2.5.33, 6.0.0–6.11.0, and 7.0.0–7.3.0, with fixes available in 6.12.0 and 7.4.0. The remaining three flaws impact availability or cause cross-request data leakage but do not lead to code execution, and only one received an “important” severity rating.