PyPI/windows-mcp CVE-2026-48989: high 8.9, EPSS 0.40%
Windows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS
Action: Upgrade windows-mcp to 0.7.5 or later.
pip install windows-mcp==0.7.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.7.5 | - |
Fixed versions
| 0.7.5 |
Sources
- osv: GHSA-vrxg-gm77-7q5g
- nvd: CVE-2026-48989
- https://github.com/CursorTouch/Windows-MCP/security/advisories/GHSA-vrxg-gm77-7q5g
- https://github.com/CursorTouch/Windows-MCP
- https://github.com/CursorTouch/Windows-MCP/releases/tag/v0.7.5
CVE-2026-48989 · published · modified · JSON