CVE-2025-49150: Cursor Agent Potentially Leaks Information using JSON schema
Cursor is a code editor built for programming with AI. Prior to 0.51.0, by default, the setting json.schemaDownload.enable was set to True. This means that by writing a JSON file, an attacker can trigger an arbitrary HTTP GET request that does not require user confirmation. Since the Cursor Agent can edit JSON files, this means a malicious agent, for example, after a prompt injection attack already succeeded, could trigger a GET request to an attacker controlled URL, potentially exfiltrating other data the agent may have access to. This vulnerability is fixed in 0.51.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49150?
CVE-2025-49150 has a high severity level due to the potential for arbitrary HTTP GET requests when manipulating JSON files.
How can I fix CVE-2025-49150?
To fix CVE-2025-49150, update to Cursor version 0.51.0 or later where the json.schemaDownload.enable setting is disabled by default.
Who is affected by CVE-2025-49150?
Users of Cursor Agent versions prior to 0.51.0 are affected by CVE-2025-49150 due to the default settings allowing unsafe file operations.
What type of attack is associated with CVE-2025-49150?
CVE-2025-49150 is associated with a vulnerability that allows attackers to perform arbitrary HTTP GET requests without user confirmation.
Is there a workaround for CVE-2025-49150 before upgrading?
As a workaround for CVE-2025-49150, users can manually change the json.schemaDownload.enable setting to False until they can upgrade.