ai-coding-tools

Why Cursor Keeps Writing Command Injection Bugs (CWE-78)

AI code editors like Cursor generate exec() calls with interpolated user input, creating CWE-78 command injection bugs. The fix: execFile/spawn with argument arrays.