{"id":"CVE-2025-62801","title":"FastMCP is the standard framework for building MCP applications","summary":"FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0, a command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hos…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-78"],"vendor":"jlowin","product":"fastmcp","affected":["fastmcp < 2.13.0"],"patched":["fastmcp 2.13.0"],"published":"2025-10-28","updated":"2026-10-08","sourceUpdated":"2026-10-08T11:10:00.250","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-62801","references":[{"url":"https://github.com/jlowin/fastmcp/security/advisories/GHSA-rj5c-58rq-j5g5","label":"security-advisories@github.com"},{"url":"https://github.com/jlowin/fastmcp/security/advisories/GHSA-rj5c-58rq-j5g5","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62801"},{"url":"https://github.com/jlowin/fastmcp"}],"tags":["nvd","osv","pip"],"epss":0.00227,"epssPercentile":0.13389,"aliases":["GHSA-rj5c-58rq-j5g5","PYSEC-2026-1365"],"ecosystem":"pip","ingestedAt":"2026-07-08T18:25:52.741Z","slug":"CVE-2025-62801","body":"## Overview\n\nFastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0, a command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor. This vulnerability is fixed in 2.13.0.\n\n## Affected\n\n- `fastmcp < 2.13.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `fastmcp 2.13.0`\n\n## Package advisory (CVE-2025-62801)\n\nAffected packages:\n\n- `fastmcp < 2.13.0`\n\nPatched in:\n\n- `fastmcp 2.13.0`\n\nSource: https://osv.dev/vulnerability/GHSA-rj5c-58rq-j5g5","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":214075,"id":"CVE-2025-62801","ts":1790811082230,"field":"cvss","old":null,"new":"7.8"},{"seq":214074,"id":"CVE-2025-62801","ts":1790811082230,"field":"severity","old":"medium","new":"high"}]}