N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-62801

CVE-2025-62801: FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name

Summary

A command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor

Details

generate_cursor_deeplink(server_name, …) embeds server_name verbatim in a cursor://…?name= query string.
open_deeplink() is invoked with shell=True only on Windows. That calls cmd.exe /c start <deeplink>.
Any cmd metacharacter inside server_name (&, |, >, ^, …) escapes the start command and spawns an attacker-chosen process.

PoC

server.py


import random
from fastmcp import FastMCP

mcp = FastMCP(name="test&calc")

@mcp.tool
def roll_dice(n_dice: int) -> list[int]:
    """Roll `n_dice` 6-sided dice and return the results."""
    return [random.randint(1, 6) for _ in range(n_dice)]

if __name__ == "__main__":
    mcp.run()

then run in the terminal: fastmcp install cursor server.py

Impact

OS Command / Shell Injection (CWE-78) Every Windows host that runs fastmcp install cursor is at risk. Developers on their local workstations, CI/CD agents and corporate build machines alike.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-62801

CVE-2025-62801:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
fastmcp	pip	< 2.13.0	2.13.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a command injection weakness in the fastmcp Python library, specifically affecting Windows users of the fastmcp install cursor command. The core of the issue lies in the insecure handling of user-provided input, which is then used in a shell command.

The analysis of the security patch, commit 5f8461b7f0eec7c6af7d7d6d8b52db909b411244, reveals that the vulnerability was addressed by removing the shell=True argument from subprocess.run calls in the codebase.

The primary vulnerable function is open_deeplink located in src/fastmcp/cli/install/cursor.py. In its vulnerable state, this function would take a deeplink string, which included an un-sanitized server_name provided by the user, and execute it on Windows using subprocess.run with shell=True. This allowed an attacker to inject malicious shell commands into the server_name field, leading to arbitrary code execution. The patch remediates this by explicitly calling cmd /c start and removing the shell=True argument, thus preventing the shell from interpreting metacharacters in the deeplink.

Additionally, the patch includes preventative fixes in other functions, namely _get_npx_command and dev in src/fastmcp/cli/cli.py, where shell=True was also removed. While the advisory does not mention an exploit path through these functions, their modification indicates a proactive hardening effort to eliminate similar command injection risks throughout the application.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-62801: FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name

Summary

Details

PoC

Impact

CVE-2025-62801:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

CVE-2025-62801: FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name

Summary

Details

PoC

Impact

N/A

N/A

Basic Information

Basic Information

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI