INFRA Signal 464
Cursor Patched Allowlist Bypass Where Shell Built-ins Silently Enabled Arbitrary Code Execution
↗
CVE-2026-22708 in Cursor allowed shell built-ins (export, typeset, declare) to execute without approval, letting attackers silently change environment variables so that commands a developer approved ran attacker code instead.
Allowlists are the primary safety mechanism most teams rely on for AI coding agents, and this bypass worked even with a completely empty allowlist. The attack turns a legitimate approval of a harmless command into arbitrary code execution, undermining the trust model that allowlists are built on.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Shell built-ins (export, typeset, declare) bypassed Cursor's allowlist because the checker only looked for programs on disk, not built-in commands.
Attackers could set environment variables like PAGER so that approved commands such as git branch ran attacker code instead of their intended action.
The bypass worked even with a completely empty allowlist, Cursor's most restrictive setting, and was patched in version 2.3.
THE CLUSTER