Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: Windsurf Clear all filters
TI-2025-38623 CVE-2025-62353 · GHSA-gxc9-77c7-jmqm

Path traversal in Windsurf

Priority HIGH 82

A path traversal vulnerability in all versions of the Windsurf IDE enables a threat actor to read and write arbitrary local files in and outside of current projects on an end user’s system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00647 Published 2025-10-17 No fix listed CWE-22
TI-2025-24928 CVE-2025-36730 · GHSA-6mh4-fc28-667v

Windsurf Prompt Injection via Filename

Priority MEDIUM 54

A prompt injection vulnerability exists in Windsurft version 1.10.7 in Write mode using SWE-1 model.

CVSS 4.0MEDIUM 4.6 Local No auth User interaction EPSS 0.00189 Published 2025-10-14 No fix listed CWE-1427