All posts
Unproven Execution

Cursor Allowlist Bypass: Unproven Execution by Design

Shell built-ins escaped Cursor's Auto-Run allowlist to poison PATH and PAGER, turning approved commands like git branch into arbitrary code execution

Securityv0 Intelligence Team OWASP: ASI05 sv0 finding: unproven_execution
cursor unproven-execution ai-coding-agent prompt-injection allowlist-bypass cve-2026-22708

The Incident

CVE-2026-22708, tracked as GHSA-82wg-qcm4-fp2w, is a terminal-tool allowlist bypass in Cursor’s AI coding agent. When Cursor is running in Auto-Run Mode with Allowlist mode enabled, the server-side command classifier enumerates external executables and treats a class of shell built-ins — export, typeset, declare, and related state-mutating primitives — as inert. The classifier does not gate them against the operator-defined allowlist, and it does not require user approval before executing them. An attacker who reaches the agent via prompt injection can therefore run built-ins to poison shell environment variables — PATH, PAGER, GIT_EDITOR — so that the next command the operator or the agent considers safe resolves to attacker-controlled code. All Cursor versions up to and including 2.2 are affected; version 2.3 requires explicit user approval for any command the server-side parser cannot classify. The primary CWE mapping is CWE-15 (External Control of System or Configuration Setting).

The advisory was published on Cursor’s GitHub Security Advisories track (GHSA-82wg-qcm4-fp2w) and credits Dan Lisichkin of the Pillar Security research team. Pillar’s public technical write-up frames the class as “The Agent Security Paradox — When Trusted Commands in Cursor Become Attack Vectors” and demonstrates both zero-click and one-click variants: the zero-click path lands the poisoning built-ins through indirect prompt injection from content the agent ingests; the one-click path convinces the operator to approve a command that looks safe in isolation but resolves to attacker-controlled code once the poisoned environment is in place. There is no public evidence of in-the-wild exploitation to date, and the CVE is not listed on the CISA KEV catalog.

MITRE ATT&CK coverage: T1574.007 (Hijack Execution Flow: Path Interception by PATH Environment Variable), T1059 (Command and Scripting Interpreter), T1068 (Exploitation for Privilege Escalation).

The Authority Path That Failed

The identity carrying execution authority at the moment of failure is the Cursor Agent — a delegated agent principal running on the developer’s workstation with the developer’s shell privileges. The operator explicitly narrowed that authority by configuring Allowlist mode: only these external commands may execute without my approval. The scope the agent held was therefore “allowlisted-external-commands-only.” The scope it exercised was broader: shell built-ins ran without ever passing through the allowlist check, because Cursor’s server-side classifier only enumerated external executables. Built-ins are not inert; they mutate the very shell state — PATH, PAGER, GIT_EDITOR — that determines how the next allowlisted command resolves.

The trust anchor that failed first is the classifier’s silent implicit trust of an unenumerated primitive class. The allowlist was advertised as the authorization gate, but a whole category of code-execution primitives sat outside it. The gap between held and exercised was flaggable before any prompt injection landed: any command the server-side parser cannot classify is, by definition, ungoverned. Comparing the operator’s stated allowlist against the agent’s runtime execution surface would have surfaced the mismatch pre-incident.

SecurityV0 Perspective

This is an unproven_execution finding. The operator configured a code-execution boundary — the allowlist — and Cursor exposed a code-execution primitive (shell built-ins that mutate environment) that was never enumerated in that boundary and was never gated by operator authorization. This is the canonical ASI05 pattern, structurally identical to the Langflow CSV Agent + Python REPL precedent: a code-execution capability wired into the agent that operators never opted into.

What To Do

  • Upgrade every developer workstation to Cursor 2.3 or later and enforce the floor at the endpoint. Every version up to and including 2.2 is affected by CVE-2026-22708. Inventory Cursor installs across your engineering estate, force the upgrade through device management, and configure your endpoint policy to refuse Cursor binaries below 2.3 — a stale local install is the only prerequisite the built-in escape needs.
  • Audit every agent tool’s declared execution surface against its actual runtime execution surface. Cursor’s server-side classifier enumerated external executables and missed built-ins. Extract every tool schema an AI coding agent exposes, list what the operator can allow-list, and compare that to what the tool actually executes when the model chooses each primitive. Anything executable at runtime but invisible at policy time is an ungoverned code-execution primitive waiting for the next disclosure.
  • Treat any primitive that mutates shell environment as a code-execution primitive, not a state-management primitive. export, unset, set, typeset, declare, cd, and eval change how the next command resolves and runs. Gate them the same way you gate an external executable — behind the allowlist, or behind an explicit operator approval — never as inert side effects.
  • Refuse “unknown → allow” fallbacks in agent authorization classifiers. Cursor’s pre-2.3 behavior treated commands the parser could not classify as inert. In code that mediates an agent’s execution authority, an unclassifiable command must default to deny or prompt for explicit approval, never to silent execution. Grep the tool-call authorization layer for “if not-classified: allow”-shaped code and rewrite each site to deny.
  • Rotate credentials touched by pre-2.3 Cursor sessions running Auto-Run and Allowlist mode. No in-the-wild exploitation has been publicly confirmed, but the primitive leaves no shell-layer forensic trace once PATH or PAGER is poisoned and the next command runs. Treat any long-lived token that a pre-2.3 Cursor Auto-Run session could reach — AWS keys in the shell environment, GitHub tokens in the credential helper, SSO cookies inside the editor’s account session — as a rotation candidate on any workstation that ingested untrusted content (MCP servers, web-search results, un-vetted repo files) before the upgrade.

Sources

All posts