CISA just dropped a warning about a zero-click vulnerability in the popular code editor. Security researchers are calling it DuneSlide (CVE-2026-61842). Hackers are actively exploiting it in the wild.
If you open a compromised repository, the attacker gets full shell access to your machine. You get zero warnings. The compromise happens instantly.
Here is exactly what you need to know and how to fix it before your Monday morning standup.
How DuneSlide Works (The Hidden Reality)
Most developers think code editors are safe sandboxes. They assume simply opening a folder can’t execute code. That’s a dangerous myth.
DuneSlide exploits how Cursor handles hidden .cursor/workspace configuration files. Attackers hide malicious payloads in these config files and push them to public GitHub repositories or npm packages.
When you clone the repo and open it in Cursor, the editor attempts to pre-load the AI context. Just like we saw with the recent fake Claude code malware, that pre-loading process triggers the exploit.
You don’t even have to run a build command. Just opening the folder is enough.
The Standard Advice (And Why It Backfires)
You’ll see a lot of advice telling you to just disable AI features temporarily. Don’t do that.
Disabling the AI chat interface doesn’t stop the background indexing engine. The background indexer is the component that actually parses the malicious config file. If you just hide the UI, you’re still vulnerable.
Some security teams are blocking GitHub entirely at the firewall level. That destroys developer productivity. It usually leads to engineers finding dangerous workarounds on their personal devices.
The Edge Cases: Are You Still Vulnerable?
Security isn’t a one-size-fits-all scenario. Here are two edge cases most blogs ignore completely:
- Air-gapped Machines: If you download a zip file of a GitHub repo on a separate machine, scan it, and move it via USB to your secure air-gapped machine, you’re still vulnerable. The exploit doesn’t need an active internet connection to execute local payload scripts.
- Using VS Code without Cursor: If you uninstall Cursor and go back to pure VS Code, you might think you are safe. You aren’t. If the Cursor AI extension is still installed and active in your VS Code profile, the
.cursor/workspacepayload can still trigger.
The Advanced Fix: Security Audit Checklist
You need a practical approach. Run through this checklist to lock down your environment today.
- Update to Version 0.45.2: Verify your version by clicking
Cursor > About. - Scan Local Repos: Check for suspicious workspace files using
find . -name "workspace" -path "*/.cursor/*" -type f. - Enforce Workspace Trust: Configure VS Code’s “Workspace Trust” via enterprise policy to open untrusted windows in Restricted Mode.
- Audit CI/CD Pipelines: Ensure your build servers aren’t automatically opening and indexing
.cursorfolders during test runs.
What Happens Next
We’ll probably see supply chain attacks spike this weekend. Attackers know developers are offline for the 4th of July holiday. They’re poisoning popular npm and PyPI packages right now hoping you pull them on Monday.
Check your versions. Talk to your team. Patch it today.
Frequently Asked Questions
Does DuneSlide affect Mac or only Windows?
It affects Mac, Windows, and Linux. The vulnerability exists in the Electron framework layer of the editor itself, making it completely cross-platform.
Can Cursor AI steal my code through this exploit?
Yes. Since the exploit grants shell access, an attacker can silently zip your entire local codebase and exfiltrate it to a remote server.
Is Restricted Mode enough to stop the attack?
Yes. Restricted Mode blocks automatic task execution and prevents the indexing engine from running the malicious payload.
Reported by CyberUpdates365 Desk
Delivering the latest insights on enterprise security, federal AI directives, and the future of IT infrastructure. Follow us for daily updates on how technology is reshaping the corporate landscape.
