{"id":"CVE-2025-62801","aliases":["EUVD-2025-36567","GHSA-rj5c-58rq-j5g5","PYSEC-2026-1365","ROOT-APP-PYPI-CVE-2025-62801"],"status":"published","title":"FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name","description":"FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0, a command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor. This vulnerability is fixed in 2.13.0.","severity":{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00227,"percentile":0.13603,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2025-10-28T21:36:41Z","modified":"2026-10-28T02:30:49Z","fixes":[{"ecosystem":"PyPI","package":"fastmcp","fixed_in":["2.13.0"],"sources":["ghsa","osv"]},{"ecosystem":"Root:PyPI","package":"rootio-fastmcp","fixed_in":["2.11.3+root.io.4","2.11.1+root.io.2","2.12.4+root.io.4","2.11.3+root.io.5","2.11.1+root.io.3","2.12.4+root.io.5"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"fastmcp","fixed_in":["2.11.3+aikido.5","2.11.1+aikido.3","2.12.4+aikido.5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"fastmcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"fastmcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.0"}]}],"versions":["0.1.0","0.2.0","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.4.0","0.4.1","1.0","2.0.0","2.1.0","2.1.1","2.1.2","2.10.0","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.6","2.11.0","2.11.1","2.11.2","2.11.3","2.12.0","2.12.0rc1","2.12.1","2.12.2","2.12.3","2.12.4","2.12.5","2.13.0rc1","2.13.0rc2","2.13.0rc3","2.2.0","2.2.1","2.2.10","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9","2.3.0","2.3.0rc1","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.4.0","2.5.0","2.5.1","2.5.2","2.6.0","2.6.1","2.7.0","2.7.1","2.8.0","2.8.1","2.9.0","2.9.1","2.9.2"]},{"source":"osv","ecosystem":"PyPI","package":"fastmcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.0"}]}],"versions":["0.1.0","0.2.0","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.4.0","0.4.1","1.0","2.0.0","2.1.0","2.1.1","2.1.2","2.10.0","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.6","2.11.0","2.11.1","2.11.2","2.11.3","2.12.0","2.12.0rc1","2.12.1","2.12.2","2.12.3","2.12.4","2.12.5","2.13.0rc1","2.13.0rc2","2.13.0rc3","2.2.0","2.2.1","2.2.10","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9","2.3.0","2.3.0rc1","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.4.0","2.5.0","2.5.1","2.5.2","2.6.0","2.6.1","2.7.0","2.7.1","2.8.0","2.8.1","2.9.0","2.9.1","2.9.2"]},{"source":"osv","ecosystem":"Root:PyPI","package":"rootio-fastmcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.3+root.io.4"},{"fixed":"2.11.1+root.io.2"},{"fixed":"2.12.4+root.io.4"},{"fixed":"2.11.3+root.io.5"},{"fixed":"2.11.1+root.io.3"},{"fixed":"2.12.4+root.io.5"}]}]},{"source":"osv","ecosystem":"Root:PyPI","package":"fastmcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.3+aikido.5"},{"fixed":"2.11.1+aikido.3"},{"fixed":"2.12.4+aikido.5"}]}]}],"products":[{"vendor":"jlowin","product":"fastmcp"}],"references":[{"url":"https://github.com/jlowin/fastmcp/security/advisories/GHSA-rj5c-58rq-j5g5","tags":["x_refsource_CONFIRM","exploit","Exploit","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62801","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rj5c-58rq-j5g5","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62801.json","tags":["advisory"]},{"url":"https://github.com/jlowin/fastmcp","tags":["package"]},{"url":"https://pypi.org/project/fastmcp","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-62801","title":"FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name","description":"FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0, a command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor. This vulnerability is fixed in 2.13.0.","status":"published","published":"2025-10-28T21:36:41.167Z","modified":"2025-10-29T14:54:56.687Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:32:54.87586Z"}],"euvd":[{"id":"EUVD-2025-36567","description":"FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0, a command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor. This vulnerability is fixed in 2.13.0.","status":"published","published":"2025-10-28T21:36:41Z","modified":"2025-10-29T14:54:56Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:49:36.236088Z"}],"ghsa":[{"id":"GHSA-rj5c-58rq-j5g5","title":"FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name","description":"### Summary\nA command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor\n\n### Details\n1. generate_cursor_deeplink(server_name, …) embeds server_name verbatim in a cursor://…?name= query string.\n2. open_deeplink() is invoked with shell=True only on Windows. That calls cmd.exe /c start \u003cdeeplink\u003e.\n3. Any cmd metacharacter inside server_name (\u0026, |, \u003e, ^, …) escapes the start command and spawns an attacker-chosen process.\n\n### PoC\nserver.py \n```\n\nimport random\nfrom fastmcp import FastMCP\n\nmcp = FastMCP(name=\"test\u0026calc\")\n\n@mcp.tool\ndef roll_dice(n_dice: int) -\u003e list[int]:\n    \"\"\"Roll `n_dice` 6-sided dice and return the results.\"\"\"\n    return [random.randint(1, 6) for _ in range(n_dice)]\n\nif __name__ == \"__main__\":\n    mcp.run()\n```\n\nthen run in the terminal:\n`fastmcp install cursor server.py`\n\n### Impact\nOS Command / Shell Injection (CWE-78)\nEvery Windows host that runs fastmcp install cursor is at risk. Developers on their local workstations, CI/CD agents and corporate build machines alike.","status":"published","published":"2025-10-29T15:39:03Z","modified":"2025-10-29T15:39:04Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:39:04.350802Z"}],"nvd":[{"id":"CVE-2025-62801","description":"FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0, a command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor. This vulnerability is fixed in 2.13.0.","status":"published","published":"2025-10-28T22:15:37.95Z","modified":"2026-10-08T11:10:00.25Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:11:40.754193Z"}],"osv":[{"id":"CVE-2025-62801","title":"FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name","description":"FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0, a command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor. This vulnerability is fixed in 2.13.0.","status":"published","published":"2025-10-28T21:36:41.167Z","modified":"2026-10-28T02:30:49.784656178Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:44:51.851511Z"},{"id":"GHSA-rj5c-58rq-j5g5","title":"FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name","description":"### Summary\nA command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor\n\n### Details\n1. generate_cursor_deeplink(server_name, …) embeds server_name verbatim in a cursor://…?name= query string.\n2. open_deeplink() is invoked with shell=True only on Windows. That calls cmd.exe /c start \u003cdeeplink\u003e.\n3. Any cmd metacharacter inside server_name (\u0026, |, \u003e, ^, …) escapes the start command and spawns an attacker-chosen process.\n\n### PoC\nserver.py \n```\n\nimport random\nfrom fastmcp import FastMCP\n\nmcp = FastMCP(name=\"test\u0026calc\")\n\n@mcp.tool\ndef roll_dice(n_dice: int) -\u003e list[int]:\n    \"\"\"Roll `n_dice` 6-sided dice and return the results.\"\"\"\n    return [random.randint(1, 6) for _ in range(n_dice)]\n\nif __name__ == \"__main__\":\n    mcp.run()\n```\n\nthen run in the terminal:\n`fastmcp install cursor server.py`\n\n### Impact\nOS Command / Shell Injection (CWE-78)\nEvery Windows host that runs fastmcp install cursor is at risk. Developers on their local workstations, CI/CD agents and corporate build machines alike.","status":"published","published":"2025-10-29T15:39:03Z","modified":"2026-07-07T17:56:56.67784165Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:55.877614Z"},{"id":"PYSEC-2026-1365","title":"FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name","description":"### Summary\nA command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor\n\n### Details\n1. generate_cursor_deeplink(server_name, …) embeds server_name verbatim in a cursor://…?name= query string.\n2. open_deeplink() is invoked with shell=True only on Windows. That calls cmd.exe /c start \u003cdeeplink\u003e.\n3. Any cmd metacharacter inside server_name (\u0026, |, \u003e, ^, …) escapes the start command and spawns an attacker-chosen process.\n\n### PoC\nserver.py \n```\n\nimport random\nfrom fastmcp import FastMCP\n\nmcp = FastMCP(name=\"test\u0026calc\")\n\n@mcp.tool\ndef roll_dice(n_dice: int) -\u003e list[int]:\n    \"\"\"Roll `n_dice` 6-sided dice and return the results.\"\"\"\n    return [random.randint(1, 6) for _ in range(n_dice)]\n\nif __name__ == \"__main__\":\n    mcp.run()\n```\n\nthen run in the terminal:\n`fastmcp install cursor server.py`\n\n### Impact\nOS Command / Shell Injection (CWE-78)\nEvery Windows host that runs fastmcp install cursor is at risk. Developers on their local workstations, CI/CD agents and corporate build machines alike.","status":"published","published":"2026-07-07T16:03:08.659725Z","modified":"2026-07-07T17:47:12.941242351Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:54.622769Z"},{"id":"ROOT-APP-PYPI-CVE-2025-62801","title":"CVE-2025-62801 in rootio-fastmcp - Patched by Root","description":"Root has patched CVE-2025-62801 in the rootio-fastmcp package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-06-03T14:52:53Z","modified":"2026-06-03T19:30:12.072304251Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:27.940619Z"}]}}