build1 distinct publisher
The command injection fix Cursor writes still runs your code
An AI editor's remediation for a CWE-78 bug was a shell metacharacter blocklist. The payload git clone ext::sh -c whoami carries none of those characters and runs code anyway.
Publishers:dev.to
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap+18
- Incentives32
- Confidence56