Potential Information Leakage using JSON schema in Cursor Agent

Medium5.9CVE-2025-49150 · Published Jun 11, 2025

### Summary By default, the setting `json.schemaDownload.enable` was set to True. This means that by writing a JSON file, an attacker can trigger an arbitrary HTTP GET request that does not require user confirmation. Since the Cursor Agent can edit JSON files, this means a malicious agent, for example, after a prompt injection attack already succeeded, could trigger a GET request to an attacker controlled URL, potentially exfiltrating other data the agent may have access to. ### Impact The impact of this vulnerability is moderate. In order to exploit this, an attacker would need to take full control of the agent, which would require stacking this upon a second exploit, such as a prompt injection attack. ### Remediation Disable `json.schemaDownload.enable` by default in Cursor.