High

Zero-click prompt injection to local RCE in Windsurf MCP configuration

IdentifiersCVE-2026-30615CWE-77· Improper Neutralization of Special…

CVE-2026-30615 is a prompt injection vulnerability in Windsurf 1.9544.26. When Windsurf processes attacker-controlled HTML content, embedded malicious instructions can influence the application to modify the local MCP configuration and automatically register a malicious MCP STDIO server. Because the registered MCP server is then executed locally, this results in arbitrary command execution on the victim system without further user interaction. The issue is described as a zero-click path in which attacker-controlled content rewrites local MCP configuration rather than requiring the user to manually approve or install the malicious server.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows arbitrary command execution in the context of the affected user on the local system. The attacker can execute commands on behalf of the user, persist access by leaving malicious MCP configuration changes in place, and access sensitive information exposed through the application or inherited by the malicious MCP server. The CVSS context provided indicates high integrity and availability impact, with limited confidentiality impact.

Mitigation

If you can’t patch tonight, do this now.

Until a patch is available, avoid opening or rendering untrusted attacker-controlled HTML content in Windsurf. Treat all external content and workspaces as untrusted. Disable or tightly restrict MCP STDIO server auto-registration and execution if configuration options exist. Monitor the local MCP configuration for unauthorized changes, remove unknown MCP server entries, and run Windsurf in a constrained environment with minimal privileges and limited access to sensitive credentials or local resources.

Remediation

Patch, then assume compromise.

Upgrade from Windsurf 1.9544.26 to a vendor-fixed version once available. The vulnerable behavior should be remediated by preventing attacker-controlled content from modifying local MCP configuration, blocking automatic registration/execution of MCP STDIO servers from untrusted content, and enforcing explicit trust and consent boundaries before any local MCP server configuration is written or executed. If the vendor has issued a security update or advisory, apply it immediately.

PUBLIC EXPLOITS

Exploits

No valid public exploits. Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.

VALID 0 / 1 TOTALView more in app

All candidate exploits were filtered out by Mallory's validation.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

WindsurfWindsurfapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

16 SOURCESView more in app

dark readingNews

Jun 29, 2026

Amazon Q VS Extension Flaw Leads to Cloud Credential Theft

A similar vulnerability in Windsurf involving automatic execution of workspace configurations through MCP, mentioned for comparison only.

cyber security newsNews

Jun 26, 2026

Amazon Q Vulnerability Let Attackers Execute Code and Access Sensitive Cloud Environments

A vulnerability in Windsurf referenced as part of a broader pattern of AI coding tool auto-execution risks.

the hacker newsNews

Jun 26, 2026

Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs

A vulnerability in Windsurf where attacker-controlled content could rewrite local MCP configuration to register a malicious server, ultimately enabling command execution.

wiz blogNews

Jun 26, 2026

Amazon Q Vulnerability: Compromise via MCP Auto-Execution | Wiz Blog

A related vulnerability mentioned as part of a broader pattern of auto-executing workspace configurations in AI coding tools; no technical details are provided in the content.

+6 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity6

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-30615

NVD

nvd.nist.gov/vuln/detail/CVE-2026-30615

MITRE CWE · CWE-77

Improper Neutralization of Special Elements…

ox.security

ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem