# FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name

- **Severity:** Critical
- **Signature ID:** `df74766d-6b33-4687-9bb4-ab4edd7e35a5`
- **CVEs:** CVE-2025-62801
- **MITRE ATLAS:** AML.T0049 (Exploit Public-Facing Application)
- **OWASP:** ASI05 (Cascading Failures in Multi-Agent Systems), LLM06 (Excessive Agency)

## Summary

FastMCP includes a helper that installs MCP servers into the Cursor editor. On Windows, the installer builds a command line using the server's name without properly sanitizing it, so a malicious or crafted server name can inject extra commands that run on the victim's machine.

## How the attack works

An attacker crafts an MCP server definition where the server_name field contains shell metacharacters or additional command text instead of a plain name. A user or automated workflow runs the FastMCP Cursor installer against this malicious server definition. The installer passes the unsanitized server_name into a Windows command line used to register the server with Cursor. The injected content executes as an additional command with the privileges of the user running the installer.

## Why it matters

An attacker who can get a victim to install or import a malicious MCP server definition can achieve arbitrary command execution on that victim's Windows machine, potentially leading to full compromise of the developer's workstation and anything it has access to.

## What you can do

- Do not run the FastMCP Cursor installer against MCP server definitions from untrusted or unverified sources.
- Review server_name and other fields in any MCP server manifest before installation for shell metacharacters or unexpected content.
- Update FastMCP to a version that fixes CVE-2025-62801 once available and applied.
- Restrict who can supply or modify MCP server definitions that get installed via automated tooling.

## Known benign look-alikes

- Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00561
- https://github.com/jlowin/fastmcp/security/advisories/GHSA-rj5c-58rq-j5g5
- https://nvd.nist.gov/vuln/detail/CVE-2025-62801
- https://github.com/advisories/GHSA-rj5c-58rq-j5g5

---
Source: https://www.netzilo.com/threats/atr-fastmcp-vulnerable-to-windows-command-injection-in-fastmcp-c