PT-2025-25236 · Cursor · Cursor

Maccarita · Published 2025-06-11 · Updated 2025-06-11 · CVE-2025-49150

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cursor versions prior to 0.51.0

Description The issue allows an attacker to trigger an arbitrary HTTP GET request without user confirmation by writing a JSON file. This could potentially be used to exfiltrate data if a malicious agent gains access, for example, after a successful prompt injection attack. The json.schemaDownload.enable setting being set to True by default prior to version 0.51.0 is the root cause.

Recommendations For versions prior to 0.51.0, update to version 0.51.0 to resolve the issue. As a temporary workaround, consider setting the json.schemaDownload.enable setting to False to prevent arbitrary HTTP GET requests.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-49150

GHSA-9H3V-H59J-V6RJ

Affected Products

Cursor

References · 7

• https://osv.dev/vulnerability/CVE-2025-49150 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49150 · Security Note
• https://github.com/getcursor/cursor/security/advisories/GHSA-9h3v-h59j-v6rj · Note
• https://twitter.com/VulmonFeeds/status/1932871321253282135 · Twitter Post
• https://t.me/cvetracker/26050 · Telegram Post
• https://twitter.com/CVEnew/status/1932865852199576064 · Twitter Post
• https://t.me/cvenotify/125423 · Telegram Post