CVE-2025-61589

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-61589", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-09-26T16:25:25.150Z", "datePublished": "2025-10-03T06:48:30.926Z", "dateUpdated": "2025-10-03T13:23:17.983Z"}, "containers": {"cna": {"title": "Cursor: Potential Information Leakage via Mermaid Diagram", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/cursor/cursor/security/advisories/GHSA-xw2x-252g-97w2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/cursor/cursor/security/advisories/GHSA-xw2x-252g-97w2"}, {"name": "https://github.com/cursor/cursor/security/advisories/GHSA-43wj-mwcc-x93p", "tags": ["x_refsource_MISC"], "url": "https://github.com/cursor/cursor/security/advisories/GHSA-43wj-mwcc-x93p"}], "affected": [{"vendor": "cursor", "product": "cursor", "versions": [{"version": "< 1.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-03T06:49:46.529Z"}, "descriptions": [{"lang": "en", "value": "Cursor is a code editor built for programming with AI. In versions 1.6 and below, Mermaid (a to render diagrams) allows embedding images which then get rendered by Cursor in the chat box. An attacker can use this to exfiltrate sensitive information to a third-party attacker controlled server through an image fetch after successfully performing a prompt injection. A malicious model (or hallucination/backdoor) might also trigger this exploit at will. This issue requires prompt injection from malicious data (web, image upload, source code) in order to exploit. In that case, it can send sensitive information to an attacker-controlled external server. Some additional bypasses not covered in the initial fix to this issue were discovered, see GHSA-43wj-mwcc-x93p. This issue is fixed in version 1.7."}], "source": {"advisory": "GHSA-xw2x-252g-97w2", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-03T13:23:05.001776Z", "id": "CVE-2025-61589", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T13:23:17.983Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-61589", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-03T13:23:05.001776Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T13:23:10.253Z"}}], "cna": {"title": "Cursor: Potential Information Leakage via Mermaid Diagram", "source": {"advisory": "GHSA-xw2x-252g-97w2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "cursor", "product": "cursor", "versions": [{"status": "affected", "version": "< 1.7"}]}], "references": [{"url": "https://github.com/cursor/cursor/security/advisories/GHSA-xw2x-252g-97w2", "name": "https://github.com/cursor/cursor/security/advisories/GHSA-xw2x-252g-97w2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/cursor/cursor/security/advisories/GHSA-43wj-mwcc-x93p", "name": "https://github.com/cursor/cursor/security/advisories/GHSA-43wj-mwcc-x93p", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Cursor is a code editor built for programming with AI. In versions 1.6 and below, Mermaid (a to render diagrams) allows embedding images which then get rendered by Cursor in the chat box. An attacker can use this to exfiltrate sensitive information to a third-party attacker controlled server through an image fetch after successfully performing a prompt injection. A malicious model (or hallucination/backdoor) might also trigger this exploit at will. This issue requires prompt injection from malicious data (web, image upload, source code) in order to exploit. In that case, it can send sensitive information to an attacker-controlled external server. Some additional bypasses not covered in the initial fix to this issue were discovered, see GHSA-43wj-mwcc-x93p. This issue is fixed in version 1.7."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-03T06:49:46.529Z"}}}, "cveMetadata": {"cveId": "CVE-2025-61589", "state": "PUBLISHED", "dateUpdated": "2025-10-03T13:23:17.983Z", "dateReserved": "2025-09-26T16:25:25.150Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-10-03T06:48:30.926Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "cursor", "vendor": "cursor", "versions": [{"status": "affected", "version": "< 1.7"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:anysphere:cursor:*:*:*:*:*:*:*:*", "matchCriteriaId": "F1643496-D7AD-4729-A51E-B3E16C0A2E5C", "versionEndExcluding": "1.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cursor is a code editor built for programming with AI. In versions 1.6 and below, Mermaid (a to render diagrams) allows embedding images which then get rendered by Cursor in the chat box. An attacker can use this to exfiltrate sensitive information to a third-party attacker controlled server through an image fetch after successfully performing a prompt injection. A malicious model (or hallucination/backdoor) might also trigger this exploit at will. This issue requires prompt injection from malicious data (web, image upload, source code) in order to exploit. In that case, it can send sensitive information to an attacker-controlled external server. Some additional bypasses not covered in the initial fix to this issue were discovered, see GHSA-43wj-mwcc-x93p. This issue is fixed in version 1.7."}, {"lang": "es", "value": "Cursor es un editor de c\u00f3digo dise\u00f1ado para programar con IA. En las versiones 1.6 e inferiores, Mermaid (una para renderizar diagramas) permite incrustar im\u00e1genes que luego son renderizadas por Cursor en el cuadro de chat. Un atacante puede usar esto para exfiltrar informaci\u00f3n sensible a un servidor controlado por un atacante de terceros a trav\u00e9s de una obtenci\u00f3n de imagen despu\u00e9s de realizar con \u00e9xito una inyecci\u00f3n de prompt. Un modelo malicioso (o una alucinaci\u00f3n/puerta trasera) tambi\u00e9n podr\u00eda activar este exploit a voluntad. Este problema requiere inyecci\u00f3n de prompt a partir de datos maliciosos (web, carga de imagen, c\u00f3digo fuente) para poder explotarlo. En ese caso, puede enviar informaci\u00f3n sensible a un servidor externo controlado por un atacante. Se descubrieron algunas derivaciones adicionales no cubiertas en la soluci\u00f3n inicial a este problema, ver GHSA-43wj-mwcc-x93p. Este problema est\u00e1 solucionado en la versi\u00f3n 1.7."}], "id": "CVE-2025-61589", "lastModified": "2026-10-19T17:10:00.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61589", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-03T13:23:05.001776Z", "version": "2.0.3"}}]}, "published": "2025-10-03T07:15:45.470", "references": [{"source": "security-advisories@github.com", "tags": ["Not Applicable"], "url": "https://github.com/cursor/cursor/security/advisories/GHSA-43wj-mwcc-x93p"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/cursor/cursor/security/advisories/GHSA-xw2x-252g-97w2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-10-06T14:43:13.440456+00:00", "updated": "2025-10-06T14:43:13.440509+00:00", "vendors": ["cursor", "cursor$PRODUCT$cursor"]}