AEV-2026-0002
Cursor terminal allowlist bypass via environment variables (CVE-2026-22708)
In Cursor versions before 2.3, shell built ins ran without reaching the terminal allowlist, letting earlier steps mutate the environment so a later approved command behaved differently than its text promised. Disclosed by Pillar Security, patched in 2.3, with no evidence of exploitation in the wild.
Affected
- Organisation
- Cursor (Anysphere)
- Product
- Cursor
- Component
- Terminal command allowlist in the Cursor Agent
- Versions
- Cursor Agent 2.2 and earlier; fixed in 2.3
- Configurations
- Auto-Run Mode with Allowlist mode enabled (non default)
Execution authority facts
Fields the evidence does not establish are shown as unknown rather than guessed.
- Intended task
- An AI coding agent running terminal commands a developer approves
- Agent
- Cursor Agent
- Delegating actor
- The developer approving commands
- Action
- Shell built ins set environment variables that changed what a later approved command did
- Target resource
- The developer's shell environment and anything the later command reached
- Environment
- The developer's workspace
- Credentials used
- unknown
- Privileges available
- The privileges of the agent's shell
- Authority presented
- A developer's approval of a specific literal command
- Authority required
- Approval of the behaviour the command would actually have once it ran
- Applicable policy
- The terminal command allowlist
- Approval mechanism
- Allowlist check plus approval prompt for unrecognised commands
- Required approver
- The developer
- Independent approval
- no
- Action binding
- The approval bound to the command text, not to the environment that decided its behaviour
- Sequence context
- An earlier unapproved built in mutated the environment before the approved command ran
Impact
- Consequence
- Arbitrary behaviour, up to code execution, reachable through an approved command in a proof of concept
- Reach
- The developer's workspace
- Reversibility
- unknown
- Detectability
- Silent: built ins ran with no allowlist check and no approval prompt
- Propagation
- A concrete chain existed; not observed spreading beyond the workspace
- Recovery
- Fixed by classifying built ins correctly; no way described to revoke one already granted approval or roll back a poisoned variable
Evidence
Primary sources
Supporting sources
- The Agent Security Paradox: When Trusted Commands in Cursor Become Attack Vectors (Pillar Security)
- Coding Agent Horror Stories: The Command You Already Approved (Docker)
- Reproduction status
- Reproduced in a proof of concept by Pillar Security; responsibly disclosed and patched
- Evidence state
- Reproduced
Known unknowns
- Whether the flaw was ever triggered outside proof of concept research.
Limitations
- No evidence in Pillar's research, Cursor's advisory or Docker's analysis that it was exploited against a real deployment before it was fixed.
Claim provenance
- verified
Cursor's own advisory assigns CVE-2026-22708, rates it High, and records the affected and fixed versions.
You Approved the Right Command. The Agent Executed Something Else. - independent-reporting
Pillar Security's proof of concept chain sets PYTHONWARNINGS, BROWSER and PERL5OPT to reach execution through an ordinary command.
You Approved the Right Command. The Agent Executed Something Else.