CVE-2025-62800mediumCWE-79

CVE-2025-62800: fallo de gravedad media en jlowin fastmcp

FastMCP vulnerable to reflected XSS in client's callback page

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear fastmcp+ Monitorear fastmcp

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.3%
FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0 have a reflected cross-site scripting vulnerability in the OAuth client callback page (oauth_callback.py) where unescaped user-controlled values are inserted into the generated HTML, allowing arbitrary JavaScript execution in the callback server origin. The issue is fixed in version 2.13.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Productos afectados
jlowin · fastmcp
CVEs relacionadas — jlowin fastmcp

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-64340MEDIUMFastMCP has a Command Injection vulnerability - Gemini CLIEPSS 0.7%CVE-2025-69196HIGHFastMCP OAuth Proxy token reuse across MCP serversEPSS 0.4%CVE-2025-62801MEDIUMFastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_nameEPSS 0.2%CVE-2026-27124HIGHFastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy VulnerabilitiesEPSS 0.2%