CVE-2025-36730

Windsurf Prompt Injection via Filename PUBLISHED

Description (CNA)

A prompt injection vulnerability exists in Windsurft version 1.10.7 in Write mode using SWE-1 model. It is possible to create a file name that will be appended to the user prompt causing Windsurf to follow its instructions.

Affected (CNA)

Vendor / product	Versions
Windsurf / Windsurf	affected 1.10.7

CWE

CWE-1427

References

https://www.tenable.com/security/research/tra-2025-47

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.