CVE-2025-49150: Cursor Code Editor SSRF Vulnerability

CVE-2025-49150 Overview

CVE-2025-49150 affects Cursor, an AI-powered code editor, in versions prior to 0.51.0. The vulnerability stems from the default configuration setting json.schemaDownload.enable being set to True. This default enables an attacker to trigger arbitrary HTTP GET requests by writing a JSON file, without requiring user confirmation. Because the Cursor Agent can edit JSON files, a malicious agent following a successful prompt injection could issue GET requests to attacker-controlled URLs. The flaw enables exfiltration of data the agent has access to. The issue is classified under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Attackers leveraging prompt injection can exfiltrate sensitive data from the Cursor Agent's context to attacker-controlled endpoints via unauthenticated HTTP GET requests.

Affected Products

Cursor code editor versions prior to 0.51.0
Deployments with default json.schemaDownload.enable setting
Cursor Agent workflows that permit editing JSON files

Discovery Timeline

2025-06-11 - CVE-2025-49150 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49150

Vulnerability Analysis

Cursor ships with the json.schemaDownload.enable setting enabled by default. When a JSON file references an external schema through the $schema property, the editor issues an HTTP GET request to fetch that schema. The editor performs this fetch silently without prompting the user for confirmation.

The Cursor Agent, an AI-driven assistant, can create and modify JSON files within a workspace. An attacker who has already achieved prompt injection against the agent can instruct it to write a JSON file containing an attacker-controlled $schema URL. Cursor then dispatches an outbound GET request to that URL, and the attacker can append sensitive data as query parameters or path components. This turns the agent into an exfiltration channel for source code, secrets, or other context the model has ingested.

Root Cause

The root cause lies in the insecure default configuration combined with missing user consent for outbound network requests triggered by workspace files. Automatic schema resolution treats any file-referenced URL as trusted, providing no allowlist or interactive confirmation before contacting an external host.

Attack Vector

Exploitation requires a prior prompt injection or another mechanism enabling the attacker to influence agent behavior. After compromising the agent's instructions, the attacker directs it to write a JSON file whose $schema value points to an attacker-controlled endpoint. Sensitive data is encoded into the URL. When Cursor parses the file, it silently performs a GET request, delivering the exfiltrated data to the attacker.

Detection Methods for CVE-2025-49150

Indicators of Compromise

Outbound HTTP GET requests from Cursor processes to unfamiliar external hosts containing long, encoded query strings or path segments.
Newly created or modified JSON files in developer workspaces containing $schema URLs pointing to non-standard domains.
DNS lookups from developer endpoints to domains not associated with official JSON schema repositories such as json-schemastore.org or vendor CDNs.

Detection Strategies

Monitor endpoint network telemetry for Cursor-initiated connections and baseline normal schema hosts, alerting on deviations.
Inspect version-controlled JSON files during code review or CI for suspicious external $schema references.
Correlate agent activity logs with outbound network events to identify agent-triggered exfiltration patterns.

Monitoring Recommendations

Log and retain outbound HTTP requests from developer workstations, including full destination URLs where policy permits.
Track installed Cursor versions across the fleet and flag hosts running versions earlier than 0.51.0.
Alert on prompt injection indicators such as unexpected file writes or configuration changes performed by AI agents.

How to Mitigate CVE-2025-49150

Immediate Actions Required

Upgrade Cursor to version 0.51.0 or later on every developer workstation.
Set json.schemaDownload.enable to false in user and workspace settings until upgrades are verified.
Audit recent JSON files created or modified by the Cursor Agent for suspicious $schema URLs.

Patch Information

The vulnerability is fixed in Cursor 0.51.0. Refer to the GitHub Security Advisory GHSA-9h3v-h59j-v6rj for full remediation details.

Workarounds

Disable automatic JSON schema downloads by configuring json.schemaDownload.enable to false in Cursor settings.
Restrict developer endpoint egress to an allowlist of known schema repositories via proxy or firewall rules.
Limit Cursor Agent permissions so it cannot autonomously edit configuration or JSON files without human review.

bash

# Configuration example: disable automatic schema downloads in Cursor settings.json
{
  "json.schemaDownload.enable": false
}