CVE-2025-62801

Published October 28th, 2025

View on NVD ↗

CVSS v3

7.8

HIGH

CVSS v2

N/A

Affected

PROJECT

Description

FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0, a command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor. This vulnerability is fixed in 2.13.0.

PrefectHQ/fastmcp

🚀 The fast, Pythonic way to build MCP servers and clients.

GitHub

25.5K