Cursor Terminal Allowlist Bypass Lets Malicious Project Files Hijack AI Commands

A vulnerability tracked as CVE-2026-22708 affects Cursor's terminal allowlist, allowing a maliciously named file in a project directory to intercept and replace trusted shell commands. The flaw stems from the allowlist checking only the command name rather than the binary the shell actually executes, meaning a local script named 'curl' can run instead of the system binary. AI coding agents are particularly at risk because they frequently execute shell commands inside directories they did not create. A developer has extended an open-source defensive toolkit, secops-toolkit-mcp, with a static analysis check that flags relative command names vulnerable to this path-shadowing pattern. The check cannot catch all edge cases through static analysis alone, but it correctly identifies the core CVE-2026-22708 exploit pattern and recommends using absolute binary paths as a mitigation.