CVE-2025-58062: openmcp-client VSCode Plugin RCE Flaw

CVE-2025-58062 Overview

CVE-2025-58062 is an OS command injection vulnerability [CWE-78] in LSTM-Kirigaya's openmcp-client, a Visual Studio Code plugin for Model Context Protocol (MCP) developers. The flaw affects Windows users who connect to an attacker-controlled MCP server. An attacker can provision a malicious authorization server endpoint that triggers command execution inside the open() invocation. Successful exploitation leads to full client system compromise under the privileges of the VSCode user. The vendor patched the issue in version 0.1.12.

Critical Impact
Connecting to a malicious MCP server on Windows allows attackers to silently execute arbitrary OS commands on the developer workstation, compromising confidentiality, integrity, and availability.

Affected Products

LSTM-Kirigaya openmcp-client versions prior to 0.1.12
Windows platform installations of the VSCode plugin
Developer environments connecting to untrusted MCP servers

Discovery Timeline

2025-08-28 - CVE-2025-58062 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58062

Vulnerability Analysis

The openmcp-client plugin integrates Model Context Protocol servers into a VSCode workflow. When the client initiates an authorization flow, it invokes the platform open() helper to launch the authorization server endpoint URL in the user's browser. On Windows, this helper passes the URL through a shell-interpretable pathway without sanitization. An attacker controlling the MCP server can return a crafted authorization endpoint string that breaks out of the URL context and injects arbitrary commands. The commands execute under the developer's user account, granting access to source code, credentials, and any resources reachable from the workstation. The EPSS score is 1.259% (percentile 65.7), reflecting moderate predicted exploitation activity.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The plugin trusted the authorization_endpoint value returned by a remote MCP server and passed it directly to a process-launching API. Windows shell semantics interpret characters such as &, |, and ^ as command separators, enabling injection when the URL is not strictly validated.

Attack Vector

Exploitation requires the victim to connect their openmcp-client instance to an attacker-controlled MCP server. The malicious server responds during the authorization handshake with a crafted endpoint string containing embedded shell metacharacters. When the client invokes open() against this string on Windows, the operating system parses and executes the injected payload. No additional privileges are required beyond the user's existing VSCode session, and the attack proceeds without further user interaction once the connection is established.

Verified proof-of-concept code is not publicly available. Technical specifics are described in the GitHub Security Advisory GHSA-43m4-p3rv-c4v8 and the patch commit.

Detection Methods for CVE-2025-58062

Indicators of Compromise

Unexpected child processes spawned by Code.exe or the openmcp-client extension host on Windows
Outbound connections from VSCode to untrusted or newly registered MCP server endpoints
cmd.exe or powershell.exe invocations originating from the VSCode extension process tree
Authorization endpoint URLs containing shell metacharacters such as &, |, ^, or backticks

Detection Strategies

Hunt for process lineage where the VSCode extension host launches shell interpreters or scripting engines
Inspect HTTP responses from MCP servers for malformed authorization_endpoint fields containing command separators
Audit installed VSCode extensions to identify openmcp-client versions earlier than 0.1.12
Correlate browser-launch events with subsequent suspicious process executions on developer endpoints

Monitoring Recommendations

Enable command-line auditing on Windows developer workstations to capture full process arguments
Forward Sysmon Event ID 1 (process creation) telemetry to a central analytics platform for VSCode child-process review
Alert on first-time connections from developer hosts to unknown MCP servers or authorization endpoints

How to Mitigate CVE-2025-58062

Immediate Actions Required

Upgrade openmcp-client to version 0.1.12 or later on all Windows developer workstations
Inventory VSCode installations and remove any vulnerable extension instances that cannot be updated
Restrict outbound connections from developer endpoints to a vetted allowlist of MCP servers
Review process execution telemetry from the past 90 days for signs of post-exploitation activity

Patch Information

The maintainer released a fix in version 0.1.12. The corrective code is published in commit 9c3799d. Users should obtain the patched release through the VSCode Marketplace or the project's GitHub releases. Refer to the GitHub Security Advisory for the full vendor statement.

Workarounds

Avoid connecting openmcp-client to MCP servers operated by untrusted parties until patched
Run VSCode under a low-privilege Windows account to limit the impact of command injection
Use application allowlisting to block shell interpreters from being spawned by VSCode processes

bash

# Verify installed openmcp-client version on Windows (PowerShell)
code --list-extensions --show-versions | Select-String "openmcp-client"

# Update to the patched release
code --install-extension LSTM-Kirigaya.openmcp-client@0.1.12 --force