Terminal Tool Allowlist Bypass via Environment Variables

Summary

When the Cursor Agent is running in Auto-Run Mode with Allowlist mode enabled, certain shell built-ins can still be executed without appearing in the allowlist and without requiring user approval.

This allows an attacker - via indirect or direct prompt injection to poison the shell environment by setting, modifying, or removing environment variables that influence trusted commands.

Impact

Works on any workspace where the agent runs in the non-default **Auto-Run Mode + Allowlist mode** and the victim executes commands that depend on environment variables, and can lead to bypassing the command allowlist. When chained with a prompt injection or malicious model vulnerability, this can lead to arbitrary code execution.

Remediation

Terminal command parsing around edge cases was improved.

Credit

The vulnerability was discovered by Dan Lisichkin from Pillar Security Research team