FastMCP vulnerabilities

In FastMCP prior to version 3.2.0, the _build_url() method in the RequestDirector class lacks URL encoding of path parameters. This allows an attacker to inject ../ sequences and perform a path traversal attack, enabling access to arbitrary internal endpoints.

In FastMCP prior to version 3.2.0, a Confused Deputy vulnerability was found in the OAuthProxy component. During GitHub OAuth integration, the server does not properly validate user consent, which combined with GitHub skipping the consent screen enables an attack.

A vulnerability in FastMCP before version 3.2.0. Server names containing shell metacharacters (e.g., &) can cause command injection on Windows during installation via fastmcp install claude-code or gemini-cli.

In the FastMCP library before version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. The token is issued for the base_url passed to the OAuthProxy during initialization, not for the specific MCP server.