Threats affecting pkg:github/cursortouch/Windows-MCP

Windows-MCP versions prior to 0.7.5 have a vulnerability where certain HTTP modes expose the MCP control plane without authentication and enable wildcard CORS. This allows attackers to access the control plane from arbitrary origins or non-browser clients and execute arbitrary PowerShell commands as the Windows user running Windows-MCP. The issue is fixed in version 0.7.5.