CVE Intelligence

Windsurf vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Windsurf products: 1 record(s), with severity, exploitation and fixes.

Windsurf 1

Exploited only (KEV) →

CVE-2025-36730 Medium · 4.6 Oct 14, 2025
Windsurf Prompt Injection via Filename
A prompt injection vulnerability exists in Windsurft version 1.10.7 in Write mode using SWE-1 model. It is possible to create a file name that will be appended to the user prompt causing Windsurf to follow its instructions.