CVE-2026-30615: Windsurf prompt injection allows arbitrary command execution via HTML content

Summary

A prompt injection flaw in Windsurf 1.9544.26 lets remote attackers run arbitrary commands on a victim system. When Windsurf processes attacker-controlled HTML, injected instructions can modify the local MCP configuration and automatically register a malicious MCP STDIO server, with no further user interaction. Successful exploitation can execute commands as the user, persist the malicious configuration, and expose sensitive information accessible through the application.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Topics

• Model Context Protocol
• Prompt injection and jailbreaks

Related items

• HighCVE-2026-76066: IntentKit authorization bypass lets callers execute owner-restricted toolsSimilar attack · NVD/CVE Database
• LowAgents at the Edge: Extending AI Security Governance to Physical AI with DefenseClawSimilar attack · Cisco AI Blog
• InfoMMA-SafetyBench: A Benchmark for Multimodal Agent Safety EvaluationSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoPolicy-Verified Self-Training: Learning Agent Compliance from Verifiable Policy RewardsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumVisual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)Similar attack · Embrace The Red