CVE-2025-62801
NoneFastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name
CVSS
—
EPSS
0.2%
Published
Oct 29, 2025
CISA due date
—
The record
A command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | fastmcp | 0 | 2.13.0 |
Related vulnerabilities
- GHSA-rj5c-58rq-j5g5 FastMCP vulnerable to windows command injection in FastMCP Cursor installer via… Same vulnerability
- GHSA-rcfx-77hg-w2wv FastMCP updated to MCP 1.23+ due to CVE-2025-66416 Also affects fastmcp
- GHSA-mxxr-jv3v-6pgc FastMCP vulnerable to reflected XSS in client's callback page Also affects fastmcp
- GHSA-c2jp-c369-7pvx FastMCP Auth Integration Allows for Confused Deputy Account Takeover Also affects fastmcp
- CVE-2025-62800 FastMCP vulnerable to reflected XSS in client's callback page Also affects fastmcp
- CVE-2026-96376 Improper Neutralization of Special Elements used in an OS Command ("OS Command… CWE-78
- CVE-2026-113732 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113776 virtualenv is a tool for creating isolated virtual python environments. CWE-78