QwikSec

Security Database

CVE

CWE

Training

CVE-2025-62801

Published: Oct 28, 2025

Modified: Oct 29, 2025

PUBLISHED

Description

FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0, a command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor. This vulnerability is fixed in 2.13.0.

Vendor	Product	Versions
jlowin	fastmcp	affected `< 2.13.0`

Weaknesses (CWE)

References

https://github.com/jlowin/fastmcp/security/advisories/GHSA-rj5c-58rq-j5g5

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.