Vulnerability · Published Aug 28, 2025 · Assigned by GitHub_M

CVE-2025-58062LSTM-Kirigaya's openmcp-client Vulnerable to RCE in MCP Authorization Flow

High 7.3

In plain English

A high-severity OS command injection in openmcp-client from LSTM-Kirigaya. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).

Severity (CVSS 4.0)7.3High

Exploit odds (30 days)1.2%top 31.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

LSTM-Kirigaya's openmcp-client is a vscode plugin for mcp developer. Prior to version 0.1.12, when users on a Windows platform connect to an attacker controlled MCP server, attackers could provision a malicious authorization server endpoint to silently achieve an OS command injection attack in the open() invocation, leading to client system compromise. This issue has been patched in version 0.1.12.

Affected products (as reported)

Vendor	Product	Versions
LSTM-Kirigaya	openmcp-client	< 0.1.12

Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/LSTM-Kirigaya/openmcp-client/security/advisories/GHSA-43m4-p3rv-c4v8 x_refsource_CONFIRM
https://github.com/LSTM-Kirigaya/openmcp-client/commit/9c3799d6ffae8d0cdfab25a53af75e1afc85f6c3 x_refsource_MISC
https://drive.google.com/file/d/1lSqFkc412aX6a_fjmNfzXsJKE7b8jPqD/view?usp=sharing x_refsource_MISC