CVE-2026-22708 is a critical flaw (CVSS 9.8) in the Cursor code editor before version 2.3. With the Agent in Auto-Run Mode and allowlist mode on, some shell built-ins run without approval, so prompt injection can poison the shell environment. The fix is Cursor 2.3, so update.
What's affected
Cursor before 2.3. The fixed version is 2.3.
Per the advisory, the issue applies when the Agent runs in Auto-Run Mode with Allowlist mode enabled, which is not the default Auto-Run configuration. It matters most when you run commands that read environment variables.
How to check if you're exposed
In Cursor, open the About dialog from the Help menu and read the version. Anything before 2.3 is affected.
Then check your settings. Look at whether the Agent is set to Auto-Run, and whether it uses an allowlist. If your team shares settings through a managed policy, check that too.
Also list which repositories and documents your agent reads. The attack route is prompt injection, which means instructions hidden in content the agent processes, such as a file, a web page or an issue.
What to do now
- Update Cursor to 2.3 or later on every developer machine.
- Review Auto-Run settings, and prefer approval before commands run for any project that handles secrets.
- Keep allowlists short, and include only commands you know well.
- Treat content from outside your team, such as dependencies, issues and web pages, as untrusted input to the agent.
- Do not store long lived secrets in shell environment variables on machines where an agent runs commands.
- Include AI coding tools in your software inventory and patch policy.
Why it matters
The weaknesses are CWE-15, CWE-269, CWE-74, CWE-77, CWE-78 and CWE-94. The common thread is that a boundary meant to separate trusted commands from untrusted ones had a gap. The advisory says certain shell built-ins could run without appearing in the allowlist and without approval, which let an attacker change, set or remove environment variables that influence trusted commands.
That matters because an allowlist implies that listed commands are safe. If the environment around them can be altered, a trusted command can behave differently. The advisory says that chained with a prompt injection or a malicious model, this can lead to arbitrary code execution. The vendor remediation was improved parsing of terminal commands for edge cases.
The record does not say it is exploited in the wild, and it is not on the CISA KEV list.
Quick check
Is this the default configuration?
No. The advisory says it applies to the non default Auto-Run Mode with Allowlist mode enabled.
What is prompt injection here?
Instructions placed in content the agent reads, direct or indirect, that steer it into running commands the user did not intend.
Who found it?
The advisory credits the Pillar Security Research team.
Sources
Last reviewed: 19 October 2026.
