Approved Git commands run malicious payloads via environment variable hijacking

On January 14, 2026, Pillar Security disclosed CVE-2026-22708 affecting Cursor's AI coding agent in Auto-Run Mode, patched in version 2.3. The vulnerability allowed shell built-ins (export/typeset/declare) to modify environment variables without triggering approval prompts. When developers subsequently approved benign commands like git branch, the commands executed attacker-defined payloads from previously set variables like PAGER or PYTHONWARNINGS. The flaw bypassed allowlists entirely as built-ins don't exist as disk executables. Docker's documentation contrasts this with sandbox approaches that enforce boundaries at the container level rather than command-line approval systems.