Vulnerability · Published Jun 11, 2025 · Assigned by GitHub_M

CVE-2025-49150Cursor Agent Potentially Leaks Information using JSON schema

Medium 5.9

In plain English

A medium-severity information exposure in cursor from getcursor. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.4%top 67.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Cursor is a code editor built for programming with AI. Prior to 0.51.0, by default, the setting json.schemaDownload.enable was set to True. This means that by writing a JSON file, an attacker can trigger an arbitrary HTTP GET request that does not require user confirmation. Since the Cursor Agent can edit JSON files, this means a malicious agent, for example, after a prompt injection attack already succeeded, could trigger a GET request to an attacker controlled URL, potentially exfiltrating other data the agent may have access to. This vulnerability is fixed in 0.51.0.

Affected products (as reported)

Vendor	Product	Versions
getcursor	cursor	< 0.51.0

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/getcursor/cursor/security/advisories/GHSA-9h3v-h59j-v6rj x_refsource_CONFIRM