CVE-2025-49150 Cursor Agent Potentially Leaks Information using JSON schema
A malicious agent can trigger arbitrary HTTP GET requests via JSON schema downloads, potentially exfiltrating sensitive data accessible to the editor.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-49150?
CVE-2025-49150 is a medium-severity server-side request forgery vulnerability in getcursor cursor, published on 11 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Cursor is a code editor built for programming with AI. Prior to 0.51.0, by default, the setting json.schemaDownload.enable was set to True. This means that by writing a JSON file, an attacker can trigger an arbitrary HTTP GET request that does not require user confirmation. Since the Cursor Agent can edit JSON files, this means a malicious agent, for example, after a prompt injection attack already succeeded, could trigger a GET request to an attacker controlled URL, potentially exfiltrating other data the agent may have access to. This vulnerability is fixed in 0.51.0.
Weakness: CWE-200
Which versions are affected by CVE-2025-49150?
How do I fix CVE-2025-49150?
No fix has been published for CVE-2025-49150 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-49150 being exploited?
There is no known exploitation of CVE-2025-49150 in the wild and no public exploit code.