CVE-2025-49150: Cursor code editor JSON schema download allows unconfirmed HTTP GET requests

Summary

Cursor, an AI code editor, prior to 0.51.0 enabled json.schemaDownload.enable by default. An attacker who can write a JSON file can trigger an arbitrary HTTP GET request without user confirmation. A malicious Cursor Agent, for example after a successful prompt injection, could send such a request to an attacker-controlled URL and exfiltrate data the agent can access.

Mitigation

Fixed in 0.51.0.

Related items

• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
• MediumDocker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) | Endor LabsSimilar attack · Endor Labs Blog
• MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research
• InfoRight Tool, Wrong Parameters: Defending LLM Agents Against Parameter PoisoningSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)