PT-2025-44217 · Fastmcp · Fastmcp

Published 2025-10-28 · Updated 2026-04-14 · CVE-2025-62800

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FastMCP versions prior to 2.13.0

Description FastMCP, a framework for building MCP applications, is affected by a reflected cross-site scripting issue. The problem exists in the OAuth client callback page (oauth callback.py) due to the insertion of unescaped user-controlled values into the generated HTML. This allows for the execution of arbitrary JavaScript code within the callback server origin.

Recommendations Update to version 2.13.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-62800

GHSA-MXXR-JV3V-6PGC

Affected Products

Fastmcp

References · 15

• 🔥 https://github.com/jlowin/fastmcp/security/advisories/GHSA-mxxr-jv3v-6pgc · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62800.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-62800 · Security Note
• https://osv.dev/vulnerability/GHSA-mxxr-jv3v-6pgc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62800 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2025-62800 · Vendor Advisory
• https://github.com/jlowin/fastmcp · Note
• https://github.com/jlowin/fastmcp/pull/2090 · Note
• https://github.com/jlowin/fastmcp/commit/2a20f54617a37213ed83894a8c2f0ac38a2e83a3 · Note
• https://twitter.com/CVEnew/status/1983290303554695526 · Twitter Post
• https://t.me/CVEtracker/36006 · Telegram Post
• https://t.me/cveNotify/140850 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1983364040857473429 · Twitter Post
• https://t.me/cveNotify/142035 · Telegram Post
• https://t.me/cveNotify/140762 · Telegram Post