CVE-2026-22708 — Cursor has a Terminal Tool Allowlist Bypass via Environment Variables

CVE-2026-22708

Cursor has a Terminal Tool Allowlist Bypass via Environment Variables PUBLISHED

Description (CNA)

Cursor is a code editor built for programming with AI. Prior to 2.3, hen the Cursor Agent is running in Auto-Run Mode with Allowlist mode enabled, certain shell built-ins can still be executed without appearing in the allowlist and without requiring user approval. This allows an attacker via indirect or direct prompt injection to poison the shell environment by setting, modifying, or removing environment variables that influence trusted commands. This vulnerability is fixed in 2.3.

Affected (CNA)

Vendor / product	Versions
cursor / cursor	affected < 2.3

CWE

CWE-15, CWE-74, CWE-77, CWE-78, CWE-94, CWE-269

References

https://github.com/cursor/cursor/security/advisories/GHSA-82wg-qcm4-fp2w

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.