> CVE-2025-58062

« BACK_TO_HOME
PUBLISHED
2025-08-28 23:15
MODIFIED
2025-08-29 16:24
EPSS (Prob. Exploit)
1.22%
Top 31.2%
DATA SOURCES:
NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 OSV 🔗 2026-11-08

> DESCRIPTION

LSTM-Kirigaya's openmcp-client is a vscode plugin for mcp developer. Prior to version 0.1.12, when users on a Windows platform connect to an attacker controlled MCP server, attackers could provision a malicious authorization server endpoint to silently achieve an OS command injection attack in the open() invocation, leading to client system compromise. This issue has been patched in version 0.1.12.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

LSTM-Kirigaya's openmcp-client Vulnerable to RCE in MCP Authorization Flow

AFFECTED PACKAGES:
Unknown / Unknown
13 versions affected
ALIASES:
GHSA-43m4-p3rv-c4v8

> HISTORIQUE DES MODIFICATIONS

Première apparition
28/08/2025 23:15
Source: NVD
📊 ENRICHISSEMENT 18/10/2025 15:07
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 1 Dernière mise à jour: 1 year ago
« BACK_TO_HOME