Codeium Windsurf Path Traversal Vulnerability (CVE-2025-62353)

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#

include('compat.inc');

if (description)
{
  script_id(342127);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/02");

  script_cve_id("CVE-2025-62353");

  script_name(english:"Codeium Windsurf Path Traversal Vulnerability (CVE-2025-62353)");

  script_set_attribute(attribute:"synopsis", value:
"The Windsurf instance installed on the remote host is affected by a path traversal vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Windsurf installed on the remote host is affected by a path traversal vulnerability:

  - A path traversal vulnerability in all versions of the Windsurf IDE enables a threat actor to read and write
    arbitrary local files in and outside of current projects on an end user's system. The vulnerability can be
    reached directly and through indirect prompt injection. (CVE-2025-62353)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://www.hiddenlayer.com/sai-security-advisory/2025-10-windsurf
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?cd85d1e7");
  # https://www.sentinelone.com/vulnerability-database/cve-2025-62353/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a3605758");
  script_set_attribute(attribute:"solution", value:
"See vendor advisory.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-62353");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/01");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:codeium:windsurf");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Artificial Intelligence");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("codeium_windsurf_win_installed.nbin", "codeium_windsurf_nix_installed.nbin", "codeium_windsurf_mac_detect.nbin");
  script_require_keys("installed_sw/Codeium Windsurf", "Settings/ParanoidReport");

  exit(0);
}

include('vdf.inc');

# Sentinel One provided workarounds to mitigate this. Codeium never backported the fix, and the vuln was removed when 
# Windsurf was acquired and transitioned into Devin Desktop, and the Cascade engine was completely deprecated.
# Used the last known version prior to the transition to Devin Desktop v3.0. Paranoia in place due to mitigation
# workarounds that we cannot check for.

if (report_paranoia < 2)
  audit(AUDIT_PARANOID);

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'paranoia': true}}
  ],
  'checks': [
    {
      'product': {'name': 'Codeium Windsurf', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {
          'max_version' : '2.3.15', 'fixed_display' : 'See vendor advisory'
        }
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);