High · published January 14, 2026
⚡ A sneaky way into your shell! Before version 2.3, the Cursor code editor with Allowlist mode could let bad actors execute shell commands without needing a ticket, just like an unmonitored guest sneaking into a party! Think of it like a restaurant where customers can make changes to the kitchen orders without the chef or waitstaff ever checking the menu — just because the restaurant has a list of approved dishes doesn’t mean every ingredient is safe. An attacker could potentially poison the shell environment, altering or removing crucial environment variables. This manipulation might change the course of trusted commands, leading to unauthorized actions or data exposure. It’s a big risk that could spell chaos for your development process!
Think of it like a restaurant where customers can make changes to the kitchen orders without the chef or waitstaff ever checking the menu — just because the restaurant has a list of approved dishes doesn’t mean every ingredient is safe. This vulnerability allows certain shell built-ins to execute without being checked against the Allowlist when the Cursor Agent runs in Auto-Run Mode. This can be triggered by prompt injection, bypassing standard controls.
An attacker could potentially poison the shell environment, altering or removing crucial environment variables. This manipulation might change the course of trusted commands, leading to unauthorized actions or data exposure. It’s a big risk that could spell chaos for your development process! Upgrade to version 2.3 immediately to patch this vulnerability. Ensure that your team is aware of the implications of indirect prompt injections and review your security practices around shell commands. Implement regular audits of permissions and environment variables! You've got this! Stay vigilant and secure your environment today! 🛡️