Cursor versions prior to 2.3 allow an Allowlist mode to be bypassed through environment variable manipulation, enabling shell built‑ins to run without user approval. This vulnerability can be triggered by direct or indirect prompt injection, enabling an attacker to poison the shell environment, alter environment variables that influence trusted commands, and potentially execute arbitrary commands or elevate privileges within the user session.

The affected product is Cursor, a code editor that supports AI programming. All releases earlier than version 2.3 are vulnerable. This includes any 2.2.x or earlier snapshot of Cursor.

The vulnerability has a CVSS score of 7.2, indicating high severity. The EPSS score is less than 1%, suggesting a low probability of exploitation at present. It is not listed in the CISA KEV catalog. The likely attack vector involves manipulating environment variables via prompt injection or local configuration changes when the Cursor Agent operates in Auto‑Run Mode with Allowlist enabled, leading to unauthorized command execution.