GHSA-rj5c-58rq-j5g5: FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name

Summary

A command-injection flaw (CWE-78) in FastMCP's Cursor installer lets an attacker who controls the server_name field run arbitrary OS commands on Windows hosts running fastmcp install cursor. The server_name value is embedded unescaped in a cursor:// deeplink, which is opened with shell=True through cmd.exe /c start, so cmd metacharacters such as & or | spawn an attacker-chosen process.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• fastmcpPyPILLM dependency since 2024-11-30 · 15 tracked dependents

Related items

• LowAnthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection FlawsSimilar attack · The Hacker News
• CriticalCVE-2026-108263: Astron Agent code-node execution as root through workflow run endpointsSimilar attack · NVD/CVE Database
• MediumHackers abuse Google Ads, Bing redirects to push Claude ClickFix attacksSimilar attack · BleepingComputer
• CriticalHermes Agent - PKCE Session Takeover via Redirect-URI Parser ConfusionSimilar attack · Tenable Research Advisories
• LowSocial Engineering AI Agents: The New BEC for 2026Similar attack · Dark Reading