Pillar Cursor Prompt Injection Flaw (CVE-2026-22708)
Date: 2026-01
Affected: Cursor IDE
Attack vector: prompt-injection
Category: research
Severity: High

Pillar disclosed CVE-2026-22708 in Cursor where prompt injection abused agentic tools intended for constrained operations to perform unintended actions due to weak input validation.


Mitigations:

Architectural layers (MAESTRO):