Model Context Protocol

CVE-2025-15063 is a command injection flaw in the execAsync method of the Ollama MCP Server. It stems from the lack of proper validation of a user-supplied string before the string is used in a system call. Remote attackers can exploit it without authentication to execute code in the context of the service account.

MCP Manager for Claude Desktop contains a command injection sandbox escape flaw tracked as CVE-2026-0757, reported as ZDI-CAN-27810. The flaw lies in processing of MCP config objects, where a user-supplied string is used in a system call without proper validation. A remote attacker who gets a target to visit a malicious page or open a malicious file can escape the sandbox and run arbitrary code at medium integrity.

Anthropic's MCP TypeScript SDK, versions up to and including 1.25.1, contains a regular expression denial of service (ReDoS) flaw (CVE-2026-0621) in the UriTemplate class when it processes RFC 6570 exploded array patterns. The dynamically generated regular expression contains nested quantifiers that can cause catastrophic backtracking on crafted input, driving CPU use up. An attacker who supplies a malicious URI can make the Node.js process unresponsive.

GHSA-rcfx-77hg-w2wv concerns FastMCP, which does not use the affected components of the MCP SDK directly. However, FastMCP versions prior to 2.14.0 allowed MCP SDK versions below 1.23, which are vulnerable to CVE-2025-66416.

The Model Context Protocol (MCP) Python SDK did not enable DNS rebinding protection by default for HTTP-based servers. A malicious website could exploit DNS rebinding to send requests to an unauthenticated HTTP MCP server running on localhost that was built with FastMCP using streamable HTTP or SSE transport and without TransportSecuritySettings, invoking its tools or accessing its resources on the user's behalf. Servers using stdio transport are not affected.

The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. When such a server runs on localhost without authentication, using StreamableHTTPServerTransport or SSEServerTransport without enableDnsRebindingProtection enabled, a malicious website could bypass same-origin policy restrictions and invoke tools or access resources on the user's behalf. The issue does not affect servers using stdio transport.

FastMCP's Entra ID integration, as documented, makes the MCP server act as both an OAuth client to Entra ID and an authorization server to MCP clients, with its own `/authorize`, `/token` and `/register` endpoints. The reported issue is a confused deputy scenario that can lead to account takeover, though the source text provided is truncated before the attack details are stated.

CVE-2025-61591 affects Cursor, a code editor built for programming with AI, in versions 1.7 and below. When MCP uses OAuth authentication with an untrusted MCP server, an attacker can impersonate that server and return crafted commands during interaction, enabling command injection. Chained with an untrusted MCP service via OAuth, the flaw could let the agent execute arbitrary code on the host with full user privileges.

Cursor versions 1.6 and below are vulnerable to remote code execution through Visual Studio Code workspace files. An attacker who hijacks the victim's chat context, for example via a compromised MCP server, can use prompt injection to make the Cursor Agent write to a .code-workspace file. This bypasses the fix for CVE-2025-54130 by modifying workspace settings, which leads to RCE.