CVE-2025-62801

EUVD-2025-36567
FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0, a command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor. This vulnerability is fixed in 2.13.0.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 8%
Affected Products (NVD)
VendorProductVersion
jlowinfastmcp
𝑥
< 2.13.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/jlowin/fastmcp/security/advisories/GHSA-rj5c-58rq-j5g5
https://github.com/jlowin/fastmcp/security/advisories/GHSA-rj5c-58rq-j5g5