CVE-2026-30615

Name of the Vulnerable Software and Affected Versions Windsurf version 1.9544.26 Cursor (affected versions not specified) VS Code (affected versions not specified) Claude Code (affected versions not specified) Gemini-CLI (affected versions not specified)

Description A prompt injection issue allows remote attackers to execute arbitrary commands on a victim system without user interaction. The flaw occurs when the software processes attacker-controlled HTML content, which can lead to the unauthorized modification of the local Model Context Protocol (MCP) configuration. This process enables the automatic registration of a malicious MCP STDIO server, allowing attackers to execute commands on behalf of the user, maintain persistence through configuration changes, and access sensitive information. This is achieved via configuration file poisoning, where MCP server configurations stored in JSON files within project directories are rewritten.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.