Cursor IDE: Arbitrary Data Exfiltration Via Mermaid (CVE-2025-54132)
Cursor is a popular AI code editor. In this post I want to share how I found an interesting data exfiltration issue, the demo exploits built and how it got fixed. When using Cursor I noticed that it can render Mermaid diagrams. Cursor Renders Mermaid Diagrams If you are not familiar with Mermaid, it has a simple syntax: graph TD User --> Computer This will create a diagram as follows:
Summary from Embrace The Red.
Explained
The technology and terms in this story. Learn more
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.
More in Vulnerabilities
SANS Stormcast Tuesday, October 27th, 2026: Apple Patches 304 Vulnerabilities Incl. Exploited CoreGraphics Flaw; Threat Hunting in DShield SIEM with ELK; .NET and PHP Brotli Fixes (CVE-2026-111497)
Podcast7 minSANS Internet Storm Center StormCast3h agoThreat IntelEndpointVulnerabilitiesCVE-2026-111497CVE-2026-28864+2