CVE-2025-62801

HIGH · 7.8 CVSS Gepubliceerd: 28-10-2025 CWE-78

Beschrijving

FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0, a command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor. This vulnerability is fixed in 2.13.0.

Vendors

Jlowin

Affected products

Fastmcp

References

github.com