Potential Information Leakage using JSON schema in Cursor Agent

Summary

By default, the setting json.schemaDownload.enable was set to True. This means that by writing a JSON file, an attacker can trigger an arbitrary HTTP GET request that does not require user confirmation.

Since the Cursor Agent can edit JSON files, this means a malicious agent, for example, after a prompt injection attack already succeeded, could trigger a GET request to an attacker controlled URL, potentially exfiltrating other data the agent may have access to.

Impact

The impact of this vulnerability is moderate. In order to exploit this, an attacker would need to take full control of the agent, which would require stacking this upon a second exploit, such as a prompt injection attack.

Remediation

Disable json.schemaDownload.enable by default in Cursor.