CVE-2025-54132: Cursor data exfiltration through Mermaid image rendering in chat

Summary

CVE-2025-54132 affects Cursor, a code editor built for programming with AI, in versions below 1.3. Mermaid diagram rendering allows embedded images that Cursor displays in the chat box, and an attacker can use this to exfiltrate sensitive information to an attacker-controlled server via an image fetch after a successful prompt injection. The flaw can also be triggered by a malicious or backdoored model, and exploitation requires prompt injection from malicious data such as web content, image uploads or source code.

Mitigation

Fixed in version 1.3.

Topics

• Prompt injection and jailbreaks

Related items

• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
• MediumDocker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) | Endor LabsSimilar attack · Endor Labs Blog
• MediumGoogle: LLMjacking attacks rack up $1 million in cloud AI chargesSimilar attack · BleepingComputer
• MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research