CVE-2025-54132

Cursor is a code editor built for programming with AI. In versions below 1.3, Mermaid (which is used to render diagrams) allows embedding images which then get rendered by Cursor in the chat box. An attacker can use this to exfiltrate sensitive information to a third-party attacker controlled server through an image fetch after successfully performing a prompt injection. A malicious model (or hallucination/backdoor) might also trigger this exploit at will. This issue requires prompt injection from malicious data (web, image upload, source code) in order to exploit. In that case, it can send sensitive information to an attacker-controlled external server. This is fixed in version 1.3.

CVSS v3 4.4 MEDIUM

4.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.7 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/cursor/cursor/security/advisories/GHSA-43wj-mwcc-x93p	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:anysphere:cursor:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-08-01 23:15

Updated : 2025-08-25 01:48

NVD link : CVE-2025-54132

Mitre link : CVE-2025-54132

CVE.ORG link : CVE-2025-54132

JSON object : View

Products Affected

anysphere

cursor

CWE

CWE-918

Server-Side Request Forgery (SSRF)

NVD-CWE-noinfo

{"id": "CVE-2025-54132", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.7}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2025-08-01T23:15:24.753", "references": [{"url": "https://github.com/cursor/cursor/security/advisories/GHSA-43wj-mwcc-x93p", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-918"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Cursor is a code editor built for programming with AI. In versions below 1.3, Mermaid (which is used to render diagrams) allows embedding images which then get rendered by Cursor in the chat box. An attacker can use this to exfiltrate sensitive information to a third-party attacker controlled server through an image fetch after successfully performing a prompt injection. A malicious model (or hallucination/backdoor) might also trigger this exploit at will. This issue requires prompt injection from malicious data (web, image upload, source code) in order to exploit. In that case, it can send sensitive information to an attacker-controlled external server. This is fixed in version 1.3."}, {"lang": "es", "value": "Cursor es un editor de c\u00f3digo creado para programar con IA. En versiones anteriores a la 1.3, Mermaid (utilizado para renderizar diagramas) permite incrustar im\u00e1genes que Cursor renderiza en el cuadro de chat. Un atacante puede usar esto para exfiltrar informaci\u00f3n confidencial a un servidor externo controlado por un atacante mediante la obtenci\u00f3n de una imagen tras realizar con \u00e9xito una inyecci\u00f3n de aviso. Un modelo malicioso (o alucinaci\u00f3n/puerta trasera) tambi\u00e9n podr\u00eda activar este exploit a voluntad. Este problema requiere la inyecci\u00f3n de aviso desde datos maliciosos (web, subida de im\u00e1genes, c\u00f3digo fuente) para explotarlo. En ese caso, puede enviar informaci\u00f3n confidencial a un servidor externo controlado por el atacante. Esto se solucion\u00f3 en la versi\u00f3n 1.3."}], "lastModified": "2025-08-25T01:48:43.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:anysphere:cursor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6CC3BD06-C788-4AE8-80B9-8CF608AB5F5F", "versionEndExcluding": "1.3"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}