CVE-2026-22708: Cursor Terminal Tool Allowlist Bypass via Environment Variables
Cursor, an AI-focused code editor, can run certain shell built-ins without them appearing in the allowlist or requiring user approval when Agent Auto-Run Mode with Allowlist mode is enabled, according to the record. The record states that prompt injection could use this to alter environment variables that influence trusted commands, and that the issue is fixed in 2.3. NVD rates it critical (CVSS 3.1 9.8), while the record also lists a GitHub CVSS 4.0 score of 7.2.
Overview
The record describes Cursor, an AI-oriented code editor, in which the Agent running in Auto-Run Mode with Allowlist mode enabled can execute certain shell built-ins without them appearing in the allowlist and without user approval. The record states this affects versions before 2.3 and is fixed in 2.3. The weakness is classified as CWE-77 (Command Injection).
Impact
- Allowlist controls over agent terminal activity may not cover every shell behavior.
- According to the record, prompt injection, direct or indirect, could change shell environment variables that influence commands already treated as trusted.
- NVD scores the issue CVSS 3.1 9.8 (critical) with high confidentiality, integrity and availability impact in its vector. GitHub lists CVSS 4.0 7.2.
- The practical consequences in a specific environment depend on which trusted commands read the affected variables, which the record does not detail.
Affected products and versions
- Anysphere Cursor, versions before 2.3, as listed in the record.
- Cursor Cursor, versions before 2.3, as listed in the record.
- The fixed version is 2.3, according to the record description. The structured fixes field in the record is empty.
Exploitation status
- The CISA KEV catalog does not list this CVE in the record.
- No confirmed exploitation appears in the sources consulted.
- The record's SSVC data marks exploitation as none and automatable as no.
- The record gives an EPSS probability of 0.00817 with a percentile of 0.56714, dated 2026-10-23.
Remediation and mitigation
- Update Cursor to version 2.3 or later, as the record indicates this version contains the fix.
- Until the update is applied, consider limiting or disabling Auto-Run Mode and reviewing allowlist settings for agent-run commands.
- Require manual approval for agent-initiated terminal actions where the product allows it.
- Reduce exposure to untrusted content that the agent reads, since the record names prompt injection as the trigger path.
- After agent sessions, review shell configuration and environment settings for unexpected changes.
Detection guidance
- Review agent session logs for shell commands that ran without a matching allowlist entry or approval record.
- Monitor for unexpected changes to shell profile files and to environment variables used by trusted commands.
- The available sources do not provide specific indicators of compromise for this issue.
Limitations of the available information
- The record does not describe the exact built-ins involved or the specific trusted commands affected.
- The affected version expressions are given only as before 2.3, and no later affected ranges are described.
- The record contains a vendor advisory reference, but this analysis relies on the record text and does not add details beyond it.
- No exploitation data beyond KEV status, SSVC fields and EPSS is provided.
Frequently asked questions
Which Cursor versions are affected by CVE-2026-22708?
The record lists Cursor versions before 2.3 as affected. The description states the issue is fixed in 2.3.
Is this vulnerability known to be exploited in the wild?
The record shows no KEV listing for this CVE, and no confirmed exploitation appears in the sources consulted. SSVC marks exploitation as none.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.