CVE-2025-62800
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
FastMCP versions prior to 2.13.0 have a reflected cross-site scripting vulnerability in the OAuth client callback page (oauth_callback.py) where unescaped user-controlled values are inserted into the generated HTML, allowing arbitrary JavaScript execution in the callback server origin. The issue is fixed in version 2.13.0.
Risk Assessment
An attacker could exploit this to execute scripts in the server context, potentially leading to theft of OAuth tokens or session hijacking.
Recommendation
Upgrade FastMCP to version 2.13.0 or later, which fixes the issue.
Other vulnerabilities in FastMCP
See all- CVE-2026-32871Critical
In FastMCP prior to version 3.2.0, the _build_url() method in the RequestDirector class lacks URL encoding of path parameters. This allows an attacker to inject ../ sequences and perform a path traversal attack, enabling access to arbitrary internal endpoints.
- CVE-2026-27124Medium
In FastMCP prior to version 3.2.0, a Confused Deputy vulnerability was found in the OAuthProxy component. During GitHub OAuth integration, the server does not properly validate user consent, which combined with GitHub skipping the consent screen enables an attack.
- CVE-2025-64340Medium
A vulnerability in FastMCP before version 3.2.0. Server names containing shell metacharacters (e.g., &) can cause command injection on Windows during installation via fastmcp install claude-code or gemini-cli.
- CVE-2025-69196Medium
In the FastMCP library before version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. The token is issued for the base_url passed to the OAuthProxy during initialization, not for the specific MCP server.
- CVE-2025-62801High
FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0, a command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor. This vulnerability is fixed in 2.13.0.
Original NVD description (English source)
FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0 have a reflected cross-site scripting vulnerability in the OAuth client callback page (oauth_callback.py) where unescaped user-controlled values are inserted into the generated HTML, allowing arbitrary JavaScript execution in the callback server origin. The issue is fixed in version 2.13.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS