Cursor terminal allowlist bypass via environment variables (CVE-2026-22708)
In Cursor versions before 2.3, shell built ins ran without reaching the terminal allowlist, letting earlier steps mutate the environment so a later approved command behaved differently than its text promised. Disclosed by Pillar Security, patched in 2.3, with no evidence of exploitation in the wild.
Affected
- Organisation
- Cursor (Anysphere)
- Product
- Cursor
- Component
- Terminal command allowlist in the Cursor Agent
- Versions
- Cursor Agent 2.2 and earlier; fixed in 2.3
- Configurations
- Auto-Run Mode with Allowlist mode enabled (non default)
Execution authority facts
Fields the evidence does not establish are shown as unknown rather than guessed.
- Intended task
- An AI coding agent running terminal commands a developer approves
- Agent
- Cursor Agent
- Delegating actor
- The developer approving commands
- Action
- Shell built ins set environment variables that changed what a later approved command did
- Target resource
- The developer's shell environment and anything the later command reached
- Environment
- The developer's workspace
- Credentials used
- unknown
- Privileges available
- The privileges of the agent's shell
- Authority presented
- A developer's approval of a specific literal command
- Authority required
- Approval of the behaviour the command would actually have once it ran
- Applicable policy
- The terminal command allowlist
- Approval mechanism
- Allowlist check plus approval prompt for unrecognised commands
- Required approver
- The developer
- Independent approval
- no
- Action binding
- The approval bound to the command text, not to the environment that decided its behaviour
- Sequence context
- An earlier unapproved built in mutated the environment before the approved command ran
Impact
- Consequence
- Arbitrary behaviour, up to code execution, reachable through an approved command in a proof of concept
- Reach
- The developer's workspace
- Reversibility
- unknown
- Detectability
- Silent: built ins ran with no allowlist check and no approval prompt
- Propagation
- A concrete chain existed; not observed spreading beyond the workspace
- Recovery
- Fixed by classifying built ins correctly; no way described to revoke one already granted approval or roll back a poisoned variable
Evidence
Primary sources
Supporting sources
- The Agent Security Paradox: When Trusted Commands in Cursor Become Attack Vectors (Pillar Security)
- Coding Agent Horror Stories: The Command You Already Approved (Docker)
- Reproduction status
- Reproduced in a proof of concept by Pillar Security; responsibly disclosed and patched
- Evidence state
- Reproduced
Known unknowns
- Whether the flaw was ever triggered outside proof of concept research.
Limitations
- No evidence in Pillar's research, Cursor's advisory or Docker's analysis that it was exploited against a real deployment before it was fixed.
Claim provenance
- verified
Cursor's own advisory assigns CVE-2026-22708, rates it High, and records the affected and fixed versions.
You Approved the Right Command. The Agent Executed Something Else. - independent-reporting
Pillar Security's proof of concept chain sets PYTHONWARNINGS, BROWSER and PERL5OPT to reach execution through an ordinary command.
You Approved the Right Command. The Agent Executed Something Else.
Protocol evidence
Published authority architectures whose artifacts bear on the requirement this vulnerability exposes: which satisfy it, which expose a way past it, and which leave it unanswered.
- Supports requirement
EP Authorization Receipts (EMILIA Protocol)
Iman Schrock, EMILIA Protocol, Inc., individual submission to the IETF
Requirement A conforming signing client MUST render the human readable presentation from the exact Action Object covered by the action hash rather than from a separately supplied description
The Cursor allowlist bypass, where the approved command's behaviour was decided by unapproved state, supports EMILIA's requirement that the human readable presentation be rendered from the exact object the approval covers.