CVE-2025-54132 Cursor's Mermaid Diagram Tool is Vulnerable to an Arbitrary Image Fetch
Attackers can exfiltrate sensitive data to external servers via malicious image fetches in Mermaid diagrams, requiring prompt injection.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-54132?
CVE-2025-54132 is a medium-severity server-side request forgery vulnerability in cursor, published on 1 Aug 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Cursor is a code editor built for programming with AI. In versions below 1.3, Mermaid (which is used to render diagrams) allows embedding images which then get rendered by Cursor in the chat box. An attacker can use this to exfiltrate sensitive information to a third-party attacker controlled server through an image fetch after successfully performing a prompt injection. A malicious model (or hallucination/backdoor) might also trigger this exploit at will. This issue requires prompt injection from malicious data (web, image upload, source code) in order to exploit. In that case, it can send sensitive information to an attacker-controlled external server. This is fixed in version 1.3.
Weakness: CWE-918
Which versions are affected by CVE-2025-54132?
It affects 1 product.
Products include Anysphere Cursor.
How do I fix CVE-2025-54132?
No fix has been published for CVE-2025-54132 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-54132 being exploited?
There is no known exploitation of CVE-2025-54132 in the wild and no public exploit code.
Other vulnerabilities in cursor
- CVE-2026-50548 Cursor Desktop sandbox escape via agent-controlled working directory
- CVE-2026-50549 Cursor Desktop sandbox escape via symlink and failed path canonicalization
- CVE-2025-64106 Cursor: Speedbump Modal Bypass in MCP Server Deep-Link
- CVE-2025-64107 Cursor is Vulnerable to Path Manipulation Using Backslashes on Windows
- CVE-2025-64108 Cursor's Sensitive File Modification can Lead to NTFS Path Quirks