CVE-2025-62801: Jlowin FastMCP RCE Vulnerability

CVE-2025-62801 Overview

CVE-2025-62801 is a command injection vulnerability [CWE-78] in FastMCP, the standard framework for building Model Context Protocol (MCP) applications. Versions prior to 2.13.0 fail to sanitize the server_name field of an MCP configuration. Any attacker who can influence this field can execute arbitrary operating system commands on Windows hosts that run fastmcp install cursor. The maintainers addressed the flaw in version 2.13.0.

Critical Impact
Attackers who supply a malicious server_name value can achieve arbitrary command execution on Windows systems installing FastMCP servers through the Cursor integration.

Affected Products

jlowin FastMCP versions prior to 2.13.0
Windows hosts executing fastmcp install cursor
MCP server configurations sourced from untrusted parties

Discovery Timeline

2025-10-28 - CVE-2025-62801 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62801

Vulnerability Analysis

FastMCP provides a command-line workflow for registering MCP servers with client applications such as Cursor. When a user runs fastmcp install cursor, the tool reads server metadata and constructs a Windows command line used to launch or register the MCP server. The server_name field is passed into this command construction path without proper escaping or validation.

On Windows, command-line interpretation applies special semantics to characters such as &, |, ^, and %. If server_name contains shell metacharacters, the resulting invocation splits into multiple commands. The attacker-controlled portion executes with the privileges of the user running the install command.

Exploitation requires local access and user interaction, since a user must run fastmcp install cursor against a configuration that references a hostile server_name. Typical distribution paths include shared MCP server definitions, project repositories, and third-party MCP catalogs.

Root Cause

The root cause is missing input sanitization on the server_name field before it is embedded in a Windows command string. FastMCP treats the field as trusted metadata rather than untrusted input, which violates the neutralization requirements described in CWE-78: Improper Neutralization of Special Elements used in an OS Command.

Attack Vector

An attacker publishes or otherwise supplies an MCP server definition whose server_name includes shell metacharacters and attacker commands. A Windows user installs the server via fastmcp install cursor. The FastMCP installer builds a command line that concatenates server_name into a shell-interpreted argument. Windows then executes the injected commands under the user's account. See the GitHub Security Advisory for reference details.

Detection Methods for CVE-2025-62801

Indicators of Compromise

Unexpected child processes of fastmcp.exe, cursor.exe, or cmd.exe spawned during MCP server installation
MCP configuration files or registry entries whose server_name contains characters such as &, |, ^, >, <, or backticks
Outbound network connections initiated shortly after running fastmcp install cursor
New scheduled tasks, startup entries, or files created by the FastMCP install process

Detection Strategies

Alert on process trees where fastmcp or cursor spawns interpreters such as cmd.exe, powershell.exe, or wscript.exe.
Inspect stored MCP server manifests for server_name values containing shell metacharacters or long encoded payloads.
Correlate FastMCP install activity with subsequent credential access, persistence, or lateral movement telemetry.

Monitoring Recommendations

Log command-line arguments for all processes launched by developers using MCP tooling.
Track installations of FastMCP versions below 2.13.0 across developer endpoints and CI runners.
Monitor code repositories and internal registries for MCP definitions containing suspicious server_name values.

How to Mitigate CVE-2025-62801

Immediate Actions Required

Upgrade FastMCP to version 2.13.0 or later on every Windows host that runs the installer.
Audit existing MCP server definitions and remove or sanitize any server_name values containing shell metacharacters.
Restrict fastmcp install cursor execution to trusted, reviewed MCP configurations.

Patch Information

The vulnerability is fixed in FastMCP 2.13.0. Upgrade with pip install --upgrade fastmcp or the equivalent package manager command. Review the FastMCP GHSA-rj5c-58rq-j5g5 advisory for the full patch description.

Workarounds

Avoid running fastmcp install cursor on Windows until FastMCP is upgraded to 2.13.0.
Only install MCP servers whose configuration files originate from trusted, reviewed sources.
Manually validate the server_name field against an allowlist of alphanumeric characters before installation.

bash

# Upgrade FastMCP to the patched release
pip install --upgrade "fastmcp>=2.13.0"

# Verify the installed version
fastmcp --version