CVE-2026-22708: 
NixOS vulnerability analysis and mitigation

CVE-2026-22708 is a Terminal Tool Allowlist Bypass vulnerability in Cursor, an AI-powered code editor developed by Anysphere. When the Cursor Agent operates in Auto-Run Mode with Allowlist mode enabled, certain shell built-ins can be executed without appearing in the allowlist and without requiring user approval, enabling environment variable poisoning via prompt injection. All Cursor versions prior to 2.3 (≤ 2.2) are affected. The vulnerability was published on January 14, 2026, and carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Feedly).

The root cause is improper input validation and insufficient terminal command parsing around edge cases in the Cursor Agent's allowlist enforcement logic (CWE-15, CWE-20, CWE-74, CWE-77, CWE-78, CWE-94, CWE-269). When Auto-Run Mode and Allowlist mode are both active, shell built-in commands bypass the allowlist check entirely, allowing an attacker to set, modify, or remove environment variables (e.g., PATH, LD_PRELOAD) that influence the behavior of subsequently executed trusted commands. The attack vector is network-based and requires no authentication or user interaction — exploitation is achieved via direct or indirect prompt injection into the AI agent's context. The vulnerability was discovered by Dan Lisichkin from the Pillar Security Research team (GitHub Advisory).

Successful exploitation allows an attacker to poison the shell environment of the victim's workspace, leading to unauthorized modification of environment variables that trusted commands depend upon. When chained with a prompt injection or a malicious model response, this bypass can escalate to arbitrary code execution on the developer's machine, potentially compromising source code, credentials, API keys, and other sensitive data present in the workspace. The attack affects any workspace where the Cursor Agent runs in the non-default Auto-Run Mode with Allowlist mode enabled and the victim executes commands that rely on environment variables (GitHub Advisory, Feedly).

As of the time of reporting, no public proof-of-concept exploit code has been confirmed, and there is no evidence of active in-the-wild exploitation (Feedly). The EPSS score is approximately 0.046%, reflecting a currently low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires only network access with no privileges or user interaction, and the technique (prompt injection leading to environment variable manipulation) is well-understood in the AI agent security research community (GitHub Advisory, infinitsec).

1. Identify a target: Locate a developer using Cursor with the Cursor Agent configured in Auto-Run Mode with Allowlist mode enabled — this is a non-default configuration.
2. Craft a prompt injection payload: Prepare a malicious prompt injection payload embedded in content the Cursor Agent will process, such as a malicious file in the repository, a crafted README, a dependency package description, or a web page fetched by the agent.
3. Trigger agent processing: Cause the Cursor Agent to read or process the malicious content, injecting instructions that instruct the agent to execute shell built-in commands (e.g., export, unset) to manipulate environment variables such as PATH, LD_PRELOAD, or LD_LIBRARY_PATH.
4. Bypass the allowlist: Because shell built-ins are not subject to the allowlist check, the agent executes the environment-modifying commands without triggering user approval prompts.
5. Poison the environment: Modify PATH to point to attacker-controlled binaries, or set LD_PRELOAD to load a malicious shared library, so that subsequent trusted commands executed by the agent invoke attacker-controlled code.
6. Achieve arbitrary code execution: When the victim or the agent subsequently runs an allowlisted command that depends on the poisoned environment variable, the attacker's code executes in the context of the developer's session, enabling data exfiltration, credential theft, or further system compromise (GitHub Advisory, infinitsec).

• Logs: Cursor Agent terminal logs showing execution of shell built-in commands (export, unset, set) that were not explicitly listed in the configured allowlist; unexpected changes to environment variable values logged in shell history.
• Process/Environment: Unusual values for sensitive environment variables such as PATH, LD_PRELOAD, LD_LIBRARY_PATH, PYTHONPATH, or NODE_PATH in processes spawned by Cursor; presence of attacker-controlled directories in PATH.
• File System: Unexpected shared library files (.so or .dylib) in user-writable directories that could be loaded via LD_PRELOAD; new or modified binaries in directories prepended to PATH.
• Network: Unexpected outbound network connections from the Cursor process or child processes to unknown external IP addresses, potentially indicating data exfiltration following code execution.

Anysphere has released Cursor version 2.3, which fixes this vulnerability by improving terminal command parsing around edge cases to properly enforce the allowlist for shell built-ins. Users should upgrade to Cursor 2.3 or later immediately. As a temporary workaround for those unable to upgrade, disable Auto-Run Mode or avoid using Allowlist mode in sensitive development environments until the patch is applied (GitHub Advisory, Feedly).

The vulnerability was discovered by Dan Lisichkin of Pillar Security Research, who has published related research on prompt injection leading to RCE and sandbox escape in AI agent environments (Pillar Security). The security community has noted this as part of a broader trend of AI agent security risks, with coverage appearing in Malware News, infinitsec, and Adversa AI's OpenClaw security roundup (malware.news, Adversa AI). A researcher blog post titled "The Agent Security Paradox: When Trusted Commands In Cursor Become Attack Vectors" provided additional technical analysis of the issue (danusminimus blog).