CVE-2025-62801

Description

FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0, a command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor. This vulnerability is fixed in 2.13.0.

Risk Information

Base Score

7.8

MODERATE

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.044

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2025-62800,CVE-2025-62801 are fixed in Python-fastmcp 2.13.0	Windows
Vulnerabilities CVE-2025-62800,CVE-2025-62801 are fixed in Python-fastmcp for linux 2.13.0	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234