CVE-2026-22708: Cursor Allowlist Bypass in Auto-Run Mode

CVE-2026-22708 describes an allowlist bypass in Cursor Agent when Auto-Run Mode and Allowlist mode are enabled. Cursor is an AI-native code editor increasingly used by development teams. The vulnerability allows an attacker to execute shell built-ins without appearing in the allowlist and without requiring user approval, via direct or indirect prompt injection. The attacker can poison the shell environment by modifying or setting environment variables that influence the behavior of trusted commands.

The vulnerability is rated CVSS 9.8 critical. It was publicly disclosed on January 14, 2026, and the fix is available in version 2.3. Public signals on X indicate awareness of the flaw, with discussions mentioning potential consequences: lateral movement, privilege escalation, and supply chain tampering risks.

System administrators and IT teams must urgently verify which Cursor instances are in use. If upgrading to 2.3+ is not immediately possible, disable Auto-Run Mode or Allowlist mode as temporary mitigation. Given the high CVSS and the nature of the vulnerability, the upgrade is a priority to protect the integrity of development and build environments.