Critical One-Click RCE Flaw Exposes VS Code and Cursor Users to Remote Code Execution

A critical remote code execution (RCE) vulnerability has been disclosed affecting three popular AI coding editors: Cursor, Microsoft Visual Studio Code, and Google Antigravity. The flaw allows attackers to embed malicious commands within links placed in commit messages. Clicking on the link, which is a routine action for developers, leads to arbitrary code execution on the victim's machine.

The vulnerability stems from the fact that these editors treat such links as executable instructions rather than just data, effectively expanding the trust boundary from the network to the editor itself.

The disclosure, issued on August 5, 2026, confirms that the attack vector involves malicious commands hidden within commit messages. Once clicked, these links trigger the editor's URL handler to spawn a process, execute arbitrary commands, and grant the attacker full control over the developer's endpoint. This significantly differs from traditional phishing attacks, as the malicious link resides within the editor, making it appear trustworthy without any external pretext.

The disclosed vulnerability poses a severe risk to teams heavily relying on these AI-assisted coding environments. Most developers trust their editors implicitly, assuming they are secure. The flaw highlights the need for a reevaluation of trust boundaries within editor environments. Simply patching the vulnerable editor is not sufficient; the core issue lies in how editors interpret arbitrary schemes from unknown sources as executable instructions.

To mitigate the risk, immediate steps can be taken to harden the development environment until vendor patches become available. Firstly, developers should audit their editors' URL scheme registrations to identify any unintentionally registered handlers. For instance, on macOS, running the command `/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/Support/lsregister -dump | grep -E 'vscode|cursor|antigravity' | grep -i 'scheme'` can reveal any registered schemes.

Similarly, on Linux, checking `xdg-mime query default x-scheme-handler/vscode`, `xdg-mime query default x-scheme-handler/cursor`, and `xdg-mime query default x-scheme-handler/antigravity` can identify potential vulnerabilities.

Secondly, treat commit messages as untrusted input. Implement policies that prevent clicking on links from unfamiliar contributors. When unsure about a link, manually inspect the URL before opening it, rather than relying on middle-click or automatic activation. Scrutinize the commit message body for any suspicious links, especially those starting with `vscode://`, `cursor://`, `antigravity://`, or `file://`, and those using `javascript:` prefixes.

Thirdly, sandbox the editors to reduce the potential blast radius in case of a successful attack. Running the editor under a sandbox environment can significantly limit the impact of the vulnerability. For example, on Linux, using `bwrap` to create a restricted environment for the editor can prevent unauthorized network access. macOS users should also consider creating per-app sandbox profiles for editors and deny outbound network access by default.

Lastly, enhance security by reducing the blast radius if the editor is compromised. Ensure that developers use separate browser profiles for their regular tasks and a dedicated sandboxed environment for development activities. Store secrets in a vault rather than on the disk, and ensure that SSH keys are secured using hardware tokens like FIDO2 devices.

By implementing these measures, teams can significantly mitigate the risk associated with the RCE flaw in Cursor, VS Code, and Antigravity, ensuring a safer development environment.