{"data":{"id":"eec2ed7c-3fec-446d-9b57-e159abd231da","title":"CVE-2025-54132: Cursor is a code editor built for programming with AI. In versions below 1.3, Mermaid (which is used to render…","summary":"CVE-2025-54132 affects Cursor, a code editor built for programming with AI, in versions below 1.3. Mermaid diagram rendering allows embedded images that Cursor displays in the chat box, and an attacker can use this to exfiltrate sensitive information to an attacker-controlled server via an image fetch after a successful prompt injection. The flaw can also be triggered by a malicious or backdoored model, and exploitation requires prompt injection from malicious data such as web content, image uploads or source code.","solution":"Fixed in version 1.3.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-54132","publishedAt":"2025-08-01T23:15:24.753Z","cveId":"CVE-2025-54132","cweIds":["CWE-918"],"cvssScore":"4.4","cvssSeverity":"medium","severity":"medium","attackType":["prompt_injection","data_extraction"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Cursor"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Cursor data exfiltration through Mermaid image rendering in chat","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.004,"epssCheckedAt":"2026-11-04T00:12:27.430Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-04T18:09:29.792Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-664"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.93,"researchCategory":null,"atlasIds":["AML.T0051"],"fixes":[]}}