CVE-2026-22708: Cursor Auto-Run allowlist could be bypassed with shell built-ins that poison environment variables
In Cursor 2.2 and earlier, with Auto-Run Mode in Allowlist mode, some shell built-ins ran without being on the allowlist and without approval. Through prompt injection, an attacker could set or change environment variables so that later allowlisted commands do something else, which can lead to code execution.
What it is
Cursor advisory GHSA-82wg-qcm4-fp2w: when the agent runs in Auto-Run Mode with Allowlist mode on (not the default), certain shell built-ins could still be executed without appearing in the allowlist and without asking you.
Direct or indirect prompt injection could use them to set, modify or remove environment variables that change how trusted commands behave, effectively bypassing the allowlist. Cursor says that chained with prompt injection or a malicious model, this can lead to arbitrary code execution.
It affects workspaces where the victim then runs commands that depend on environment variables. Fixed in 2.3 by improving terminal command parsing around edge cases. Credit: Dan Lisichkin, Pillar Security.
How to check
- Cursor → About: confirm 2.3 or later.
- Check whether you or your team use Auto-Run with an allowlist. If you do, an allowlist alone isn't a security boundary against injected instructions.
How to fix
- Update Cursor to 2.3 or later.
- Keep allowlists short and avoid auto-running commands whose behaviour depends on environment variables (package managers, build tools, git hooks) when the agent is reading untrusted content.
- Use approval mode for repos, issues or web pages you don't control.