OS Command Injection Vulnerability in LSTM-Kirigaya's openmcp-client for Windows
CVE-2025-58062

7.3HIGH

Key Information:

Vendor: Lstm-kirigaya
Status: Openmcp-client
Vendor: CVE Published:; 28 August 2025

🔔 Create Lstm-kirigaya Vulnerability Alert

What is CVE-2025-58062?

A significant vulnerability exists in LSTM-Kirigaya's openmcp-client, a Visual Studio Code plugin utilized by MCP developers. Prior to version 0.1.12, users on Windows who connected to a maliciously controlled MCP server were susceptible to an OS command injection attack. This could occur when attackers provision a harmful authorization server endpoint, allowing them to exploit the open() function and potentially compromise the client system. Users are strongly advised to update to version 0.1.12 or later to mitigate this security risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch