{"id":"PYSEC-2026-1365","summary":"FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name","details":"### Summary\nA command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor\n\n### Details\n1. generate_cursor_deeplink(server_name, …) embeds server_name verbatim in a cursor://…?name= query string.\n2. open_deeplink() is invoked with shell=True only on Windows. That calls cmd.exe /c start \u003cdeeplink\u003e.\n3. Any cmd metacharacter inside server_name (&, |, \u003e, ^, …) escapes the start command and spawns an attacker-chosen process.\n\n### PoC\nserver.py \n```\n\nimport random\nfrom fastmcp import FastMCP\n\nmcp = FastMCP(name=\"test&calc\")\n\n@mcp.tool\ndef roll_dice(n_dice: int) -\u003e list[int]:\n    \"\"\"Roll `n_dice` 6-sided dice and return the results.\"\"\"\n    return [random.randint(1, 6) for _ in range(n_dice)]\n\nif __name__ == \"__main__\":\n    mcp.run()\n```\n\nthen run in the terminal:\n`fastmcp install cursor server.py`\n\n### Impact\nOS Command / Shell Injection (CWE-78)\nEvery Windows host that runs fastmcp install cursor is at risk. Developers on their local workstations, CI/CD agents and corporate build machines alike.","aliases":["CVE-2025-62801","GHSA-rj5c-58rq-j5g5"],"modified":"2026-07-07T17:47:12.941242351Z","published":"2026-07-07T16:03:08.659725Z","references":[{"type":"WEB","url":"https://github.com/jlowin/fastmcp/security/advisories/GHSA-rj5c-58rq-j5g5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62801"},{"type":"PACKAGE","url":"https://github.com/jlowin/fastmcp"},{"type":"PACKAGE","url":"https://pypi.org/project/fastmcp"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-rj5c-58rq-j5g5"}],"affected":[{"package":{"name":"fastmcp","ecosystem":"PyPI","purl":"pkg:pypi/fastmcp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.0"}]}],"versions":["0.1.0","0.2.0","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.4.0","0.4.1","1.0","2.0.0","2.1.0","2.1.1","2.1.2","2.10.0","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.6","2.11.0","2.11.1","2.11.2","2.11.3","2.12.0","2.12.0rc1","2.12.1","2.12.2","2.12.3","2.12.4","2.12.5","2.13.0rc1","2.13.0rc2","2.13.0rc3","2.2.0","2.2.1","2.2.10","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9","2.3.0","2.3.0rc1","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.4.0","2.5.0","2.5.1","2.5.2","2.6.0","2.6.1","2.7.0","2.7.1","2.8.0","2.8.1","2.9.0","2.9.1","2.9.2"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/fastmcp/PYSEC-2026-1365.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}