CVE-2026-30615: Windsurf Prompt Injection RCE Vulnerability

CVE-2026-30615 Overview

A critical prompt injection vulnerability has been identified in Windsurf version 1.9544.26 that enables remote attackers to execute arbitrary commands on victim systems. The vulnerability arises when Windsurf processes attacker-controlled HTML content containing malicious instructions. These instructions can trigger unauthorized modifications to the local Model Context Protocol (MCP) configuration and automatically register a malicious MCP STDIO server, ultimately leading to command execution without requiring additional user interaction.

Critical Impact

Successful exploitation allows attackers to execute arbitrary commands with user privileges, persist malicious MCP configuration changes for ongoing access, and access sensitive information exposed through the application.

Affected Products

• Windsurf 1.9544.26
• Earlier versions may also be affected pending vendor confirmation

Discovery Timeline

• 2026-04-15 - CVE-2026-30615 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-30615

Vulnerability Analysis

This vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command), commonly known as Command Injection. The core issue stems from Windsurf's handling of HTML content from untrusted sources, where the application fails to properly sanitize or validate input before processing it within the context of its AI-powered features.

When Windsurf encounters attacker-crafted HTML content, the embedded malicious instructions are interpreted and executed by the application's prompt processing engine. This allows adversaries to manipulate the Model Context Protocol (MCP) configuration—a critical component that manages how the application interfaces with external servers and processes commands.

The attack requires local access to be initiated, but the consequences extend to full command execution capabilities. The vulnerability enables high impact to both integrity and availability, with some information disclosure also possible. The attack complexity is low with no privileges required, making exploitation straightforward once an attacker can deliver malicious content to the application.

Root Cause

The root cause of CVE-2026-30615 lies in insufficient input validation and sanitization within Windsurf's HTML content processing pipeline. The application fails to distinguish between legitimate user instructions and injected malicious prompts embedded within HTML content. This allows attackers to craft specially designed HTML that, when processed by the application, injects commands into the MCP configuration system.

The MCP architecture relies on trust boundaries that are violated when external content can directly influence configuration changes. The automatic registration of STDIO servers without proper verification or user confirmation creates a pathway for persistent compromise.

Attack Vector

The attack vector involves delivering malicious HTML content to a Windsurf user. When the application processes this content, the injected prompt instructions bypass normal security controls and execute within the application's context. The attack flow includes:

1. Attacker crafts HTML content with embedded prompt injection payloads
2. Victim's Windsurf application processes the malicious HTML
3. Injected instructions modify the local MCP configuration
4. A malicious MCP STDIO server is automatically registered
5. Arbitrary commands execute without user awareness or additional interaction

The vulnerability enables command execution through manipulation of the MCP configuration layer, allowing the malicious server to receive and execute commands as if they were legitimate MCP operations.

For technical details on the vulnerability mechanism and exploitation techniques, refer to the Ox Security Blog Advisory which documents RCE vulnerabilities across the AI ecosystem including this class of MCP-related attacks.

Detection Methods for CVE-2026-30615

Indicators of Compromise

• Unexpected modifications to MCP configuration files or registry entries
• Presence of unauthorized MCP STDIO server registrations
• Unusual command execution activity originating from Windsurf processes
• Network connections to unknown or suspicious endpoints initiated by the application

Detection Strategies

• Monitor for changes to MCP configuration directories and files, alerting on unauthorized modifications
• Implement process monitoring to detect child processes spawned by Windsurf that deviate from normal behavior
• Deploy endpoint detection rules to identify prompt injection patterns in HTML content being processed
• Review application logs for anomalous MCP server registration events

Monitoring Recommendations

• Enable enhanced logging for Windsurf application activity, particularly around configuration changes
• Configure file integrity monitoring on MCP configuration paths
• Implement network traffic analysis to detect unexpected outbound connections from AI development tools
• Establish baseline behavior profiles for Windsurf to identify deviations indicative of compromise

How to Mitigate CVE-2026-30615

Immediate Actions Required

• Restrict Windsurf from processing HTML content from untrusted sources until a patch is available
• Review and audit current MCP configurations for unauthorized server registrations
• Implement network segmentation to limit potential lateral movement if exploitation occurs
• Consider temporarily disabling automatic MCP server registration features if configurable

Patch Information

As of the NVD publication date, users should monitor vendor channels for official security updates addressing this vulnerability. Review the Ox Security Blog Advisory for additional context on MCP supply chain vulnerabilities and recommended mitigations.

Organizations should prioritize patching once updates become available given the command execution capabilities this vulnerability enables.

Workarounds

• Configure application-level controls to prevent processing of external HTML content where possible
• Implement strict input validation at the network perimeter for content destined for AI development tools
• Deploy application allowlisting to prevent unauthorized STDIO servers from executing
• Use principle of least privilege for accounts running Windsurf to limit the impact of successful exploitation

Organizations should implement defense-in-depth measures including network monitoring, endpoint detection, and strict access controls to minimize risk exposure while awaiting official patches from the vendor.