FastMCP CVE-2025-62801

Three concrete prerequisites must all hold: (1) the host is Windows (open_deeplink() uses shell=True only on Windows, invoking cmd.exe /c start); (2) the victim runs the fastmcp install cursor command - the Cursor installer path that calls generate_cursor_deeplink() and embeds server_name into the cursor:// URL; and (3) the attacker can influence the server_name field of an MCP the victim installs (e.g. a shared or published malicious MCP server). Limiting factors: requires victim user interaction (running the install command), is inert on macOS/Linux, and is fixed in FastMCP 2.13.0. No network service is exposed - the trigger is a locally executed developer/CI workflow against attacker-supplied content.

Signals point to a genuine-but-gated code-execution flaw rather than a mass-exploitation emergency. The CWE-78 command injection yields full code execution (VC:H/VI:H/VA:H), but every exploitation signal shows narrow reach: EPSS is only 0.23% (12th percentile), there is no CISA KEV listing, and exploitation is conditioned on a Windows host, the Cursor install path, and the victim affirmatively running fastmcp install cursor against an attacker-influenced MCP. A public PoC exists in the GHSA advisory (server_name="test&calc"), which lowers the effort bar, but PoC availability is not active exploitation. The vendor's CVSS 4.0 base score of 5.4 reflects the attack requirement (AT:P) and user interaction (UI:A); a CVSS 3.1 framing of the same facts lands closer to ~7.8 because 3.1 lacks a distinct attack-requirement metric and weights full CIA impact more heavily. The signals are internally consistent (local/UI-gated vector, low EPSS, no KEV) - nothing here conflicts. Bottom line: prioritize for Windows developer/CI endpoints that use FastMCP's Cursor installer, but this is not an internet-facing or wormable issue.

An attacker publishes or shares an MCP server whose name embeds cmd.exe metacharacters (e.g. FastMCP(name="test&calc")). A Windows developer, CI agent, or build machine runs fastmcp install cursor server.py; FastMCP embeds server_name verbatim into a cursor:// deeplink and opens it via open_deeplink() with shell=True, so cmd.exe /c start parses the metacharacters and spawns the attacker's process. A working PoC is published in the GHSA advisory.