Terminal Tool Allowlist Bypass via Environment Variables

HighCVE-2026-22708 · Published Jan 14, 2026

## **Summary** When the Cursor Agent is running in `Auto-Run Mode` with `Allowlist mode` enabled, certain shell built-ins can still be executed without appearing in the allowlist and without requiring user approval. This allows an attacker - via indirect or direct prompt injection to poison the shell environment by setting, modifying, or removing environment variables that influence trusted commands. ### **Impact** Works on any workspace where the agent runs in the non-default **`Auto-Run Mode`** + **`Allowlist mode`** and the victim executes commands that depend on environment variables, and can lead to bypassing the command allowlist. When chained with a prompt injection or malicious model vulnerability, this can lead to arbitrary code execution. ### **Remediation** Terminal command parsing around edge cases was improved. ### **Credit** The vulnerability was discovered by Dan Lisichkin from Pillar Security Research team