CVE-2025-58062
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-58062
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-58062.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-58062
- Aliases
-
- GHSA-43m4-p3rv-c4v8
- Published
- 2025-08-28T23:15:44Z
- Modified
- 2025-08-29T16:59:49.858400Z
- Summary
- [none]
- Details
-
LSTM-Kirigaya's openmcp-client is a vscode plugin for mcp developer. Prior to version 0.1.12, when users on a Windows platform connect to an attacker controlled MCP server, attackers could provision a malicious authorization server endpoint to silently achieve an OS command injection attack in the open() invocation, leading to client system compromise. This issue has been patched in version 0.1.12.
- References