FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name
FastMCP includes a helper that installs MCP servers into the Cursor editor. On Windows, the installer builds a command line using the server's name without properly sanitizing it, so a malicious or crafted server name can inject extra commands that run on the victim's machine.
How the attack works
An attacker crafts an MCP server definition where the server_name field contains shell metacharacters or additional command text instead of a plain name. A user or automated workflow runs the FastMCP Cursor installer against this malicious server definition. The installer passes the unsanitized server_name into a Windows command line used to register the server with Cursor. The injected content executes as an additional command with the privileges of the user running the installer.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- df74766d-6b33-4687-9bb4-ab4edd7e35a5
- Severity
- Critical
- CVEs
- CVE-2025-62801
Why it matters
An attacker who can get a victim to install or import a malicious MCP server definition can achieve arbitrary command execution on that victim's Windows machine, potentially leading to full compromise of the developer's workstation and anything it has access to.
What you can do
- →Do not run the FastMCP Cursor installer against MCP server definitions from untrusted or unverified sources.
- →Review server_name and other fields in any MCP server manifest before installation for shell metacharacters or unexpected content.
- →Update FastMCP to a version that fixes CVE-2025-62801 once available and applied.
- →Restrict who can supply or modify MCP server definitions that get installed via automated tooling.
Known benign look-alikes
- Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.