Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2025-62801

FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0, a command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor. This vulnerability is fixed in 2.13.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

jlowin fastmcp

  • < 2.13.0affected

References