PERMISSION/PROTOCOL
Back to incident tracker

2026-01-14

HighPrimary

CVE-2026-22708: Cursor AI Allowlist Bypass via Shell Environment Poisoning Turned Trusted Commands Like 'git' into Arbitrary Code Execution

CVE-2026-22708 (CVSS 7.2): Cursor AI's terminal allowlist ignored shell built-ins, allowing attackers to poison PATH/alias and redirect allowlisted commands like 'git' to arbitrary code.

Cursor AITool execution / MCPTerminal allowlist bypass via shell environment poisoningCursor AI terminal tool — developer machine with full credential access

What happened

Attacker delivers a malicious prompt (via prompt injection in a repo file, webpage, or tool response) instructing the Cursor agent to run export PATH=/tmp/evil:$PATH or alias git=/tmp/evil/git. Subsequent invocations of allowlisted commands (git, npm, pytest) silently execute the attacker payload.

Why it matters

Full arbitrary code execution on the developer's machine with the developer's credentials. Proof-of-concept published. Exploitation vector is indirect prompt injection — malicious instructions embedded in repo files, documentation, or tool responses read by the agent during a normal task.

Missing authorization check

Shell built-in commands (export, alias, source) should require explicit authorization. An external layer verifying that the executed binary path matches the allowlisted command name at execution time would have blocked this attack.

Would PP block it?

Full coverage requires the Tool-Call Gate to enforce not just what command is requested but what binary will actually execute (resolving PATH and aliases at authorization time, not at execution time). PP's receipt model creates an audit trail; a runtime that checks the resolved binary path at execution time closes the gap. This is a harder enforcement problem than a simple allowlist.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-01-14

    CVE-2026-22708 published. Vulnerability disclosed by Pillar Security research team. CVSS 7.2. CWE-78 (OS Command Injection via prompt injection attack vector).

  2. 2026-01-23

    SentinelOne vulnerability database entry published with technical details of the shell environment poisoning vector.

  3. 2026-01-28

    DEV Community writeup by cverports publishes full exploit walkthrough: export PATH and alias bypass turns any allowlisted binary into an RCE vector. Proof-of-concept confirmed.

  4. 2026-02-03

    CVEfeed.io entry confirmed. Vulnerability fixed in Cursor version 2.3.

  5. 2026-06-11

    Vulnerability resurfaces in OWASP prompt injection roundup covering agentic IDE attack patterns from the first half of 2026.

Technical breakdown

  • Cursor Auto-Run mode uses a command allowlist to restrict which binaries the agent can execute in the terminal. The allowlist checked external binary names but did not inspect or restrict shell built-in execution (export, alias, source, eval).
  • Shell built-ins run in the current shell process context and can modify PATH, define aliases, and set environment variables — all of which affect how subsequent external binary names resolve.
  • A malicious export PATH=/tmp/evil:$PATH followed by an allowlisted git invocation causes the shell to resolve git to /tmp/evil/git (the attacker payload) without the allowlist ever seeing a non-allowlisted binary name.
  • The attack vector is indirect prompt injection: hostile instructions embedded in a repo README, documentation file, or tool API response read by the Cursor agent during a normal task.
  • The allowlist security model collapsed because it was enforced inside the agent's own shell context — the very environment the attacker could manipulate.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Tool execution / MCP. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Terminal tool invocation, command allowlist enforcement, shell environment scope
Still needs
Shell built-in commands are not subject to external authorization checks; PATH/alias state at execution time is not verified against the authorized command at approval time
Receipt required for
Every terminal tool invocation including shell built-in execution; any command that modifies the shell environment (export, alias, source)

A Tool-Call Gate requiring a receipt before any terminal tool invocation creates a human-reviewable audit trail for each command. It would not prevent environment poisoning in the same session — the attacker's export command might pass the gate — but it gives a human the opportunity to review the command before it ran.

Start small

Put the relevant gate at this action boundary.

This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop