CVE-2025-36730 — Windsurf Prompt Injection via Filename
A prompt injection vulnerability exists in Windsurft version 1.10.7 in Write mode using SWE-1 model. It is possible to create a file name that will be appended to the user prom…
Published: 2025-10-14 · CVSS: 4.6 · CVSS 4.0
A prompt injection vulnerability exists in Windsurft version 1.10.7 in Write mode using SWE-1 model. It is possible to create a file name that will be appended to the user prompt causing Windsurf to follow its instructions.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7