SSRF in Anysphere Cursor
CVE-2025-54132
Cursor is a code editor built for programming with AI. In versions below 1.3, Mermaid (which is used to render diagrams) allows embedding images which then get rendered by Cursor in the chat box. An attacker can use this to exfiltrate sensitive information to a third-party attacker controlled server through an image fetch after successfully performing a prompt injection. A malicious model (or hallucination/backdoor) might also trigger this exploit at will. This issue requires prompt injection from malicious data (web, image upload, source code) in order to exploit. In that case, it can send sensitive information to an attacker-controlled external server. This is fixed in version 1.3.
Vulnerability class: SSRF (Server-Side Request Forgery)
EPSS: 0.003 (26.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.4 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Anysphere Cursor
- Cursor — versions < 1.3
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-54132?
- CVE-2025-54132 is a medium-severity vulnerability in Anysphere Cursor, classified under Server-Side Request Forgery (SSRF). CVSS score: 4.4/10. Published 2025-08-01.
- How severe is CVE-2025-54132?
- Medium severity. CVSS v3 base score is 4.4 out of 10.
- Is CVE-2025-54132 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.