CVE-2025-54132: 
NixOS vulnerability analysis and mitigation

CVE-2025-54132 is an arbitrary image fetch vulnerability in Cursor, an AI-powered code editor developed by Anysphere, affecting versions below 1.3. The vulnerability exists in Cursor's integration of the Mermaid diagram rendering tool, which allows embedding images that are fetched and rendered in the chat box — enabling sensitive data exfiltration via prompt injection. It was published on August 1, 2025, and patched in Cursor version 1.3. The CVSS v3.1 base score is 7.5 (High) per NVD, though the GitHub Security Advisory assigns a Moderate score of 4.4 reflecting higher attack complexity and privilege requirements (GitHub Advisory, Red Hat CVE). Microsoft also addressed this vulnerability in Visual Studio 2022 updates released in October 2025 (Microsoft MSRC).

The root cause is classified as CWE-918 (Server-Side Request Forgery), where Cursor's Mermaid diagram renderer fetches externally referenced images without sanitizing or restricting the image URLs (GitHub Advisory). An attacker first performs a prompt injection using malicious data sources — such as web content, uploaded images, or source code — to cause the AI model to generate a Mermaid diagram containing an attacker-controlled image URL with sensitive data encoded in query parameters. When Cursor renders the diagram in the chat box, it fetches the image from the attacker's server, transmitting the encoded sensitive information. A malicious AI model, hallucination, or backdoored model could also trigger this exploit autonomously without user-initiated prompt injection (GitHub Advisory). A detailed technical write-up and proof-of-concept demonstration were published by researcher wunderwuzzi23 at Embrace the Red (Embrace the Red).

Successful exploitation results in unauthorized exfiltration of sensitive information from the Cursor application environment to an attacker-controlled external server, with a high confidentiality impact and no integrity or availability impact (GitHub Advisory). The data at risk includes any content accessible within the Cursor chat context — such as source code, API keys, credentials, or other developer secrets — that the AI model can be manipulated into embedding in a Mermaid diagram URL. The attack is particularly concerning in developer environments where sensitive intellectual property and credentials are routinely handled (Embrace the Red).

There is no evidence of in-the-wild exploitation or a weaponized exploit kit at this time, though a public proof-of-concept and video demonstration were published by researcher wunderwuzzi23 shortly after disclosure (Embrace the Red). The vulnerability was credited to researchers wunderwuzzi23 and MaccariTA (GitHub Advisory). The EPSS score is approximately 0.026%, indicating a low current probability of exploitation in the wild. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a successful prompt injection precondition, which raises the practical attack complexity.

1. Reconnaissance: Identify a target using Cursor IDE version below 1.3, particularly developers working with sensitive codebases, API keys, or credentials in their AI chat sessions.
2. Craft malicious input: Prepare a prompt injection payload embedded in a data source the target will feed to Cursor — such as a malicious source code file, a crafted web page, or an uploaded document — designed to instruct the AI model to generate a Mermaid diagram.
3. Inject the payload: Cause the target to open or process the malicious data in Cursor (e.g., by having them open a repository containing a malicious README or source file, or by serving a malicious web page that gets summarized by the AI).
4. Trigger Mermaid diagram generation: The prompt injection instructs the AI to produce a Mermaid diagram containing an externally hosted image URL, with sensitive context data (e.g., environment variables, file contents, chat history) encoded in the URL query string pointing to an attacker-controlled server.
5. Capture exfiltrated data: When Cursor renders the Mermaid diagram in the chat box, it fetches the attacker-controlled image URL, sending the encoded sensitive data as an HTTP request to the attacker's server, where it is logged (GitHub Advisory, Embrace the Red).

• Network: Outbound HTTP/HTTPS GET requests from the Cursor application process to unexpected external domains, particularly with long query strings or base64-encoded parameters that may contain exfiltrated data; requests to domains not associated with Cursor's normal operation originating from the Cursor process.
• Logs: Web server access logs on attacker-controlled infrastructure showing inbound requests with encoded sensitive data in URL parameters; Cursor application logs showing Mermaid diagram rendering events with external image URLs.
• Process: Cursor IDE process (cursor, cursor.exe) initiating network connections to unfamiliar external IP addresses or domains during or after AI chat sessions involving external data sources.
• File System: Presence of malicious files (e.g., source code, README files, documents) containing embedded prompt injection instructions designed to trigger Mermaid diagram generation with external image references (Embrace the Red, GitHub Advisory).

The primary remediation is to upgrade Cursor to version 1.3 or later, in which all remote images are stripped from Mermaid diagrams before rendering, eliminating the image fetch vector (GitHub Advisory). Microsoft also addressed this vulnerability in Visual Studio 2022 updates released in October 2025 for users of that integration (Microsoft MSRC). As interim workarounds, organizations should implement strict input validation for prompts and uploaded content, restrict or monitor external network connections from the Cursor process, and avoid feeding untrusted external data (web content, third-party repositories) directly into Cursor AI chat sessions (Red Hat CVE).

The vulnerability was publicly detailed by security researcher wunderwuzzi23 (Johann Rehberger) at Embrace the Red, who published a technical blog post and video demonstration, drawing significant attention to prompt injection risks in AI-powered developer tools (Embrace the Red). The disclosure was discussed on Hacker News and featured in Simon Willison's blog as part of a broader commentary on the growing wave of prompt injection vulnerabilities in AI applications, which he dubbed "the summer of Johann" (Simon Willison). The vulnerability was also highlighted in cybersecurity newsletters and threat intelligence roundups as an example of emerging AI-specific attack surfaces in developer tooling (Andy Svints Blog).