A shell built-in bypass in Cursor IDE enabled silent RCE via prompt injection (CVE-2026-22708)
CVE-2026-22708 (CVSS 9.8) allowed shell built-in commands such as export and typeset to bypass Cursor IDE's command allowlist and execute without user approval. An attacker could use indirect prompt injection to silently poison environment variables, causing trusted commands like git branch to trigger arbitrary code execution. The vulnerability was discovered by Pillar Security, disclosed on January 14, 2026, and patched in Cursor version 2.3.
Shell built-ins like export and typeset were implicitly trusted by Cursor's allowlist filter, letting prompt injection silently poison environment variables and turn benign approved commands into remote code execution vectors.
Key facts
- What
- CVE-2026-22708 (CVSS 9.8) allowed shell built-in commands such as export and typeset to bypass Cursor IDE's command allowlist and execute without user approval.
- Incident date
- Jan 14, 2026
- Who
- Anysphere
- Failure mode
- Prompt Injection
- AI surface
- Code Assistant
- Severity
- High
What happened
CVE-2026-22708 exposed a critical flaw in Cursor IDE where shell built-in commands (export, typeset, declare) bypassed the command allowlist and executed without user approval. An attacker could use indirect prompt injection, for example through a malicious repository or document, to instruct the AI agent to run these built-ins and silently modify environment variables such as PAGER, PATH, or PYTHONWARNINGS. When a user then approved a benign command like git branch, the poisoned environment caused arbitrary code execution instead of the intended operation. The vulnerability was reported to Cursor by Pillar Security on August 11, 2025, publicly disclosed on January 14, 2026, and fixed in version 2.3.
What broke inside the model
- 01 · TriggerThe model reads retrieved or user-supplied text.
- 02 · Model stepThat text carries hidden instructions.
- 03 · Control gapNothing separates untrusted data from trusted commands.
- 04 · FailureThe injected instruction overrides the operator's.
- 05 · ConsequenceThe system acts on an outsider's intent.
At the injection point, retrieved text overrides the operator's instruction.
Cursor's server-side command evaluator only checked for executable binaries on disk, not shell built-ins that are intrinsic to the shell itself. Built-ins like export, typeset, and declare were classified as safe and executed without user consent, even with an empty allowlist. This blind spot allowed prompt injection to silently manipulate the shell environment, turning subsequently approved trusted commands into arbitrary code execution vectors through poisoned environment variables such as PAGER, PYTHONWARNINGS, and LD_PRELOAD.
What it cost
Sources
Cite this entry
https://failureindex.ai/failures/shell-built-bypass-cursor-ide-enabledAI Failure Index. "A shell built-in bypass in Cursor IDE enabled silent RCE via prompt injection (CVE-2026-22708)" (FI-0174). Realm Labs. https://failureindex.ai/failures/shell-built-bypass-cursor-ide-enabled (indexed Jun 4, 2026).Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0174. Full dataset at /data.
Note from Realm Labs, the Index steward
How Realm would have caught this
- Prism
- OmniGuard
Realm inspects the model's internal state for the signature of instructions arriving through the data channel, so an injected command can be flagged and blocked inline before the model acts on it, instead of trusting a classifier that scores the input as safe.