CVE-2025-62801

HIGH

7.8

Beschreibung

FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0, a command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor. This vulnerability is fixed in 2.13.0.

CVE Details

CVSS v3.1 Bewertung7.8

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorLOCAL

KomplexitatLOW

Erforderliche PrivilegienLOW

BenutzerinteraktionNONE

Veroffentlicht10/28/2025

Zuletzt geandert11/4/2025

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

jlowin:fastmcp

Schwachen (CWE)

CWE-78

Referenzen

https://github.com/jlowin/fastmcp/security/advisories/GHSA-rj5c-58rq-j5g5(security-advisories@github.com)

https://github.com/jlowin/fastmcp/security/advisories/GHSA-rj5c-58rq-j5g5(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.