Read the docs

Windsurf

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

Windsurf records in CISA KEV

No Windsurf vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2025-38623 CVE-2025-62353 · GHSA-gxc9-77c7-jmqm

Path traversal in Windsurf

Priority HIGH 82

A path traversal vulnerability in all versions of the Windsurf IDE enables a threat actor to read and write arbitrary local files in and outside of current projects on an end user’s system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00647 Published 2025-10-17 No fix listed CWE-22
TI-2025-24928 CVE-2025-36730 · GHSA-6mh4-fc28-667v

Windsurf Prompt Injection via Filename

Priority MEDIUM 54

A prompt injection vulnerability exists in Windsurft version 1.10.7 in Write mode using SWE-1 model.

CVSS 4.0MEDIUM 4.6 Local No auth User interaction EPSS 0.00189 Published 2025-10-14 No fix listed CWE-1427
Open these records in search →