CVEvulnerability

CVE-2025-62353

9.8 CRITICAL Published 2025-10-17 Modified 2026-10-19 Official page ↗
Status
Deferred
Published
2025-10-17
Last modified
2026-10-19
Assigner
6f8de1f0-f67e-45a6-b68f-98777fdb759c
CVSS 3.1 (6f8de1f0-f67e-45a6-b68f-98777fdb759c)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-22

Description

A path traversal vulnerability in all versions of the Windsurf IDE enables a threat actor to read and write arbitrary local files in and outside of current projects on an end user’s system. The vulnerability can be reached directly and through indirect prompt injection.

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References