Cursor IDE: Arbitrary Data Exfiltration Via Mermaid (CVE-2025-54132)
Brief
Cursor is a popular AI code editor. In this post I want to share how I found an interesting data exfiltration issue, the demo exploits built and how it got fixed.
When using Cursor I noticed that it can render Mermaid diagrams.
Cursor Renders Mermaid Diagrams
If you are not familiar with Mermaid, it has a simple syntax:
graph TD User -- Computer This will create a diagram as follows: