Threats tagged 'brew-mcp-atlassian-cve-2025-62801'

A command injection vulnerability exists in the FastMCP Cursor installer component of mcp-atlassian versions 0.11.9 and 0.11.10. The vulnerability allows an attacker who can control the server_name parameter to execute arbitrary OS commands on Windows hosts running the affected software. This occurs because server_name is embedded without sanitization into a shell command executed with cmd.exe /c start, enabling command injection via Windows command metacharacters. The issue is fixed in version 0.11.11.