CVE-2025-36730: Windsurf

Medium severity, CVSS 4.6. EPSS: 0.2% chance of exploitation in the next 30 days.

A prompt injection vulnerability exists in Windsurft version 1.10.7 in Write mode using SWE-1 model. It is possible to create a file name that will be appended to the user prompt causing Windsurf to follow its instructions.

Affected products

Published 2025-10-14. Last modified 2026-06-17.