CVE-2026-22708

nvd.nist.gov • April 21, 2026

Cursor is a code editor built for programming with AI. Prior to 2.3, hen the Cursor Agent is running in Auto-Run Mode with Allowlist mode enabled, certain shell built-ins can still be executed without appearing in the allowlist and without requiring user approval. This allows an attacker via indirect or direct prompt injection to poison the shell environment by setting, modifying, or removing environment variables that influence trusted commands. This vulnerability is fixed in 2.3.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Google's Antigravity IDE Vulnerability Allows Remote Code Execution via Prompt Injection Researchers at Pillar Security discovered a critical prompt injection vulnerability in Google's Antigravity IDE, which allows for remote code execution (RCE) by exploiting insufficient input sanitization in the find_by_name tool's Pattern parameter. This flaw enables attackers to inject command-line flags into the underlying fd utility, effectively converting file operations into arbitrary code execution. The vulnerability circumvents Antigravity's Secure Mode, which is intended to restrict network access and enforce sandboxing of command operations. The issue was reported to Google on January 6, 2026, and was patched on February 28, 2026, with Pillar Security receiving a bounty for their discovery. The vulnerability is particularly concerning as it can be triggered by seemingly benign inputs, making it a significant threat to users relying on the IDE for secure development. This incident highlights the growing risks associated with agentic AI tools and the need for stricter validation of input parameters. 3 sources 71

Extracted Entities

CVE-2026-22708

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)