CVE-2026-22708: Cursor Auto-Run Mode Arbitrary Command Execution via Environment Variable Bypass

Vulnerability Overview Vulnerability Name: CVE-2026-22708 Vulnerability Description: In Cursor’s Auto-Run Mode, when the allowlist is enabled, certain shell built-in commands (such as , , and ) can be executed without passing through allowlist checks. These commands can modify environment variables, thereby bypassing allowlist restrictions to execute arbitrary commands. Vulnerability Mechanism: - Upon startup, the program reads environment variables, such as to determine the output method and to control warning messages. - An attacker can manipulate these environment variables to alter program behavior; for example, setting to would launch the Calculator application when is executed. - This attack vector leverages the characteristics of shell built-in commands and environment variables to bypass allowlist validation. Affected Scope Affected Software: Cursor Affected Versions: Versions prior to 2.3 Severity: High Impact Description: - Attackers can execute arbitrary commands by modifying environment variables, bypassing allowlist checks entirely. - This attack method requires no memory corruption or privilege escalation; it only requires a developer to approve a seemingly benign command. - Attackers can exploit this vulnerability to execute malicious code, steal sensitive information, or compromise the system. Remediation Fixed Version: Cursor 2.3 Fix Details: - Cursor version 2.3 addresses this vulnerability by ensuring that shell built-in commands are also subject to allowlist validation. - Users are advised to upgrade to the latest version to ensure security. Additional Recommendations: - Use isolated environments such as Docker Sandboxes to run AI coding agents, thereby mitigating potential security risks. - Regularly update and maintain software to ensure that all known vulnerabilities are patched promptly. Proof of Concept (POC) Summary This vulnerability exploits the interaction between shell built-in commands and environment variables to bypass allowlist checks, resulting in the execution of arbitrary commands. Attackers can execute malicious code by modifying environment variables without triggering allowlist validation. It is recommended that users upgrade to Cursor version 2.3 and implement additional security measures, such as using isolated environments, to reduce potential security risks.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-22708: Cursor Auto-Run Mode Arbitrary Command Execution via Environment Variable Bypass