CVE-2025-36730

A prompt injection vulnerability exists in Windsurft version 1.10.7 in Write mode using SWE-1 model. It is possible to create a file name…

tenable·CWE-1427·Published 2025-10-14

CVSS

—

EPSS

0.00

KEV

Exploits

cve.orgen

224 chars

A prompt injection vulnerability exists in Windsurft version 1.10.7 in Write mode using SWE-1 model. It is possible to create a file name that will be appended to the user prompt causing Windsurf to follow its instructions.

NVDen

224 chars

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
4.0	Primary	cve.org	4.6	—	—	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
4.0	Secondary	NVD	4.6	—	—