Paper/Archive/CVE-2026-22708

CVE-2026-22708

cursor cursor — Cursor has a Terminal Tool Allowlist Bypass via Environment Variables

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 57.1.571 × 2011.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Cursor is a code editor built for programming with AI. Prior to 2.3, hen the Cursor Agent is running in Auto-Run Mode with Allowlist mode enabled, certain shell built-ins can still be executed without appearing in the allowlist and without requiring user approval. This allows an attacker via indirect or direct prompt injection to poison the shell environment by setting, modifying, or removing environment variables that influence trusted commands. This vulnerability is fixed in 2.3.

Affected

ProductAffectedFixed inSource

cursor< 2.3–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

GitHub_M (CNA)7.2CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/cursor/cursor/security/advisories/GHSA-82wg-qcm4-fp2w