CVE-2026-22708: Cursor AI Code Editor RCE Vulnerability

CVE-2026-22708 Overview

CVE-2026-22708 is a vulnerability in Cursor, a code editor built for programming with AI. Prior to version 2.3, when the Cursor Agent is running in Auto-Run Mode with Allowlist mode enabled, certain shell built-ins can still be executed without appearing in the allowlist and without requiring user approval. This allows an attacker via indirect or direct prompt injection to poison the shell environment by setting, modifying, or removing environment variables that influence trusted commands.

Critical Impact

Attackers can exploit prompt injection to manipulate shell environment variables, potentially hijacking trusted command execution and bypassing security controls in Cursor's Auto-Run Mode.

Affected Products

• Cursor AI Code Editor versions prior to 2.3

Discovery Timeline

• 2026-01-14 - CVE CVE-2026-22708 published to NVD
• 2026-01-16 - Last updated in NVD database

Technical Details for CVE-2026-22708

Vulnerability Analysis

This vulnerability is classified under CWE-15 (External Control of System or Configuration Setting), which occurs when an application allows external control over system-level settings that can influence system behavior. In the context of Cursor's AI-powered code editor, the Cursor Agent's Auto-Run Mode is designed to automatically execute certain approved commands based on an allowlist configuration.

The fundamental issue lies in how shell built-in commands are handled by the security mechanism. While external commands are properly validated against the allowlist before execution, shell built-ins—such as export, unset, set, and others—bypass this validation entirely. These built-ins operate within the shell session itself rather than as separate executable binaries, creating a gap in the security model.

An attacker leveraging prompt injection (either direct manipulation or indirect injection through malicious content in processed files) can instruct the AI agent to execute shell built-ins that modify environment variables. These modified variables can then influence the behavior of subsequently executed trusted commands, effectively achieving command hijacking without triggering the approval workflow.

Root Cause

The root cause is the incomplete enforcement of the allowlist security model when the Cursor Agent is in Auto-Run Mode. Shell built-in commands are not subject to the same allowlist verification as external commands, allowing them to execute without user approval. This creates an authorization bypass where the security boundary fails to account for all executable command types within the shell environment.

Attack Vector

The attack vector is network-based through prompt injection. An attacker can craft malicious prompts—either directly through user input or indirectly through poisoned content in files, repositories, or web content processed by the AI—to manipulate the Cursor Agent into executing shell built-in commands. These commands modify environment variables such as PATH, LD_PRELOAD, LD_LIBRARY_PATH, or application-specific variables to influence how trusted allowlisted commands behave when subsequently executed.

For example, an attacker could poison the PATH variable to prioritize a malicious directory, causing a trusted command like git or npm to resolve to an attacker-controlled binary instead of the legitimate system binary. Since the environment modification occurs via shell built-ins that bypass the allowlist, the attack proceeds without triggering user approval.

For detailed technical information about this vulnerability, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-22708

Indicators of Compromise

• Unexpected modifications to shell environment variables (PATH, LD_PRELOAD, LD_LIBRARY_PATH, HOME, etc.) during Cursor Agent sessions
• Execution of shell built-in commands (export, unset, set, alias) that were not explicitly requested by the user
• Anomalous command resolution where trusted commands execute from unexpected locations
• Evidence of prompt injection patterns in AI agent interaction logs or processed content

Detection Strategies

• Monitor Cursor Agent logs for shell built-in command execution patterns, particularly environment variable modifications
• Implement runtime monitoring of environment variable changes within Cursor sessions
• Deploy endpoint detection rules to identify suspicious export or unset commands executed in rapid succession
• Analyze AI agent prompts and responses for injection patterns attempting to manipulate command execution

Monitoring Recommendations

• Enable verbose logging for Cursor Agent Auto-Run Mode sessions to capture all executed commands including shell built-ins
• Implement baseline monitoring of environment variable states before and after Cursor Agent operations
• Configure alerts for any shell environment modifications during automated agent execution
• Review processed files and repository content for potential prompt injection payloads

How to Mitigate CVE-2026-22708

Immediate Actions Required

• Upgrade Cursor to version 2.3 or later immediately to remediate this vulnerability
• Disable Auto-Run Mode until the upgrade can be completed if immediate patching is not possible
• Review Cursor Agent activity logs for any signs of environment manipulation or prompt injection attempts
• Consider running Cursor in isolated environments with restricted shell capabilities until the patch is applied

Patch Information

This vulnerability is fixed in Cursor version 2.3. Users should upgrade to this version or later to ensure protection against shell environment poisoning attacks via prompt injection. For additional details and the official security advisory, see the GitHub Security Advisory for GHSA-82wg-qcm4-fp2w.

Workarounds

• Disable Auto-Run Mode entirely and require manual approval for all agent-executed commands
• If Auto-Run Mode must be used, avoid processing untrusted files, repositories, or content that could contain prompt injection payloads
• Implement network segmentation to limit the impact of potential environment manipulation
• Use containerized or sandboxed execution environments for Cursor to limit the blast radius of any successful exploitation

# Configuration example: Disable Auto-Run Mode in Cursor settings
# Navigate to Settings > AI Agent > Auto-Run Mode
# Set "Auto-Run Mode" to "Disabled" or "Manual Approval Required"
# This ensures all agent commands require explicit user approval