A threat actor could take advantage of this by adding a malicious .vscode/tasks.json file in a publicly shared repository. "When a user opens such a repository from Cursor, even for simple browsing, ...