CVE-2025-62801: FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name

October 29, 2025

A command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor

References

github.com/advisories/GHSA-rj5c-58rq-j5g5
github.com/jlowin/fastmcp
github.com/jlowin/fastmcp/security/advisories/GHSA-rj5c-58rq-j5g5
nvd.nist.gov/vuln/detail/CVE-2025-62801

Code Behaviors & Features

Detect and mitigate CVE-2025-62801 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →