Windsurf at a glance
CVE-2026-30615 describes how attacker-controlled HTML processed by Windsurf 1.9544.26 could rewrite the local MCP configuration and register a malicious STDIO server that runs commands without further user interaction. As of November 5, no official notice names a fix.
Windsurf: status
- Affected
- Windsurf 1.9544.26 (version named in the CVE record; other versions not confirmed)
- CVE identifiers
- Status as of
- Discovered by
- OX Security
What changed with Windsurf
The CVE record, published April 15, 2026, says prompt-injection instructions hidden in HTML that Windsurf 1.9544.26 processes can modify the local MCP configuration and register a malicious MCP STDIO server. That server then runs arbitrary commands as the user without further interaction, and the change persists. OX Security disclosed it the same day as part of wider research on MCP STDIO servers.
The NVD shows a CISA-ADP score of 8.0 High (CVSS 3.1) and lists the record as Deferred, with no NIST analysis and no fixed version. The GitHub Advisory Database entry is unreviewed and also names no fix. Windsurf has since been renamed Devin Desktop, and its public changelog through version 3.11.238 (October 30) does not mention this CVE. Version 3.6.21 (July 29) added a Restricted Mode that disables agents and hooks in untrusted workspaces, but the vendor has not tied it to this flaw, so we treat the status as unconfirmed.
How to fix it: Windsurf
1. Update
Keep Windsurf, now Devin Desktop, on the latest release; no release note names a fix for this CVE yet.
docs.devin.ai (opens in a new tab)2. Configuration
Open projects and content you don't trust in Restricted Mode (added in 3.6.21), which disables agents and hooks for that workspace.
docs.devin.ai (opens in a new tab)3. Monitor
Review the IDE's local MCP configuration for STDIO servers you did not add, since the attack persists by registering one there.
nvd.nist.gov (opens in a new tab)
Advisories
Why Windsurf matters for businesses
An MCP config file is effectively a list of programs your IDE will launch. Anything that lets an agent edit it, including a web page the agent reads, can lead to code execution. Keep Windsurf or Devin Desktop on the latest release, review its MCP configuration for servers you did not add, and use Restricted Mode for projects or content you don't trust until the vendor confirms a fix.
Sources for this story
- CVE-2026-30615 Detail (opens in a new tab)Official
NIST National Vulnerability Database · nvd.nist.gov
- GHSA-wj2m-jvpr-64cq (opens in a new tab)Official
GitHub Advisory Database · github.com
- Devin Desktop changelog (formerly Windsurf) (opens in a new tab)Official
Devin Desktop docs · docs.devin.ai
- MCP supply chain advisory: RCE vulnerabilities across the AI ecosystem (opens in a new tab)Official
OX Security · ox.security
Last verified: . IA Compa summarizes public announcements for business readers. We are not affiliated with the companies mentioned. Always confirm details, pricing, and availability with the official source.
- #security
- #cve
- #prompt-injection
- #mcp
- #ai-coding-agents
- #windsurf