# Critical Vulnerability in Popular Code Editors Puts Millions at Risk

*Published August 7, 2026*
*Source: [https://cybersecuritynews.com/1-click-rce-vulnerability-in-code-editors/](https://cybersecuritynews.com/1-click-rce-vulnerability-in-code-editors/)*

## Executive Summary

A critical remote code execution vulnerability in Cursor, VS Code, and Google Antigravity exposed millions of developers to potential cyberattacks. The flaw has been patched, but the incident underscores the rapid spread of vulnerabilities across AI-driven coding tools.

## Article

A severe remote code execution vulnerability has been found affecting three widely used coding environments: Cursor, Microsoft VS Code, and Google Antigravity. This flaw, discovered by the cybersecurity firm AISLE, could have compromised approximately 50 million developers with just one click on a malicious link embedded in a Git commit message. This vulnerability allowed attackers to execute code with full terminal privileges without any user notification, leading to potential data theft, malware installation, and unauthorized file access.

The vulnerability was first identified in VS Code during automated scans in late 2025 and subsequently found in Cursor, which shares the same codebase. AISLE responsibly disclosed the issue to Microsoft and Cursor, resulting in patches being released. However, the same flaw was later found in Google Antigravity in early 2026, which was also promptly patched by Google.

This incident highlights how rapid propagation of security flaws can occur across AI-driven development tools that share common architectures. The vulnerability has since been patched in all three platforms, but developers are urged to update to the latest versions immediately. Additionally, reviewing recent commit histories and rotating exposed credentials is advised to mitigate any potential damages.