A prompt injection vulnerability exists in Windsurf version 1.9544.26. The flaw allows attackers who supply malicious HTML content to inject commands that modify the local MCP configuration. The injected instructions trigger the automatic registration of a rogue MCP STDIO server, allowing the attacker to execute arbitrary system commands on the host machine with the application’s privileges. This can lead to the execution of malicious commands, persistence of unauthorized configuration changes, and disclosure of sensitive data exposed through the application.

Windsurf 1.9544.26. No other vendor or product versions are listed, and the vulnerability is specific to this version.

The CVSS score of 8 indicates a high severity remote code execution flaw. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog, implying no publicly known exploits yet. The most likely attack vector is remote, with an attacker supplying crafted HTML content that Windsurf will process. Successful exploitation requires the attacker to deliver such content to the application; once processed, the attacker can execute arbitrary system commands, persist configuration changes, and access sensitive information.