CVE-2026-48989
2 advisories.
PyPI/windows-mcp CVE-2026-48989: high, EPSS 0.69%
Windows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS
Action: Upgrade windows-mcp to 0.7.5 or later.
pip install windows-mcp==0.7.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.7.5 | - |
Fixed versions
| 0.7.5 |
Sources
- osv: GHSA-vrxg-gm77-7q5g
- https://github.com/CursorTouch/Windows-MCP/security/advisories/GHSA-vrxg-gm77-7q5g
- https://nvd.nist.gov/vuln/detail/CVE-2026-48989
- https://github.com/CursorTouch/Windows-MCP
- https://github.com/CursorTouch/Windows-MCP/releases/tag/v0.7.5
CVE-2026-48989 · published · modified · JSON
PyPI/windows-mcp CVE-2026-48989: unknown, EPSS 0.69%
Windows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS
Action: Upgrade windows-mcp to 0.7.5 or later.
pip install windows-mcp==0.7.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.7.5 | - |
Fixed versions
| 0.7.5 |
Sources
- osv: PYSEC-2026-3425
- https://github.com/CursorTouch/Windows-MCP/security/advisories/GHSA-vrxg-gm77-7q5g
- https://nvd.nist.gov/vuln/detail/CVE-2026-48989
- https://github.com/CursorTouch/Windows-MCP
- https://github.com/CursorTouch/Windows-MCP/releases/tag/v0.7.5
- https://pypi.org/project/windows-mcp
- https://github.com/advisories/GHSA-vrxg-gm77-7q5g
CVE-2026-48989 · published · modified · JSON