MEDIUM🇵🇱 Wersja polska

CVE-2025-62800

CVSS 5.3v4.0pub. 2025-10-28upd. 2025-11-07

FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0 have a reflected cross-site scripting vulnerability in the OAuth client callback page (oauth_callback.py) where unescaped user-controlled values are inserted into the generated HTML, allowing arbitrary JavaScript execution in the callback server origin. The issue is fixed in version 2.13.0.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Jlowin Fastmcp

    APP
    Jlowin
    < 2.13.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
XSS
CWE
References

Related vulnerabilities

CVE-2026-32871CRITICAL10.0PL ✓ten sam produkt

FastMCP: path traversal i SSRF przez niekodowane parametry ścieżki URL

CVE-2026-27124HIGH8.2ten sam produkt

FastMCP is the standard framework for building MCP applications. Prior to version 3.2.0, while testing the Git...

CVE-2025-69196HIGH7.4ten sam produkt

FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not ...

CVE-2025-64340MEDIUM6.7ten sam produkt

FastMCP is the standard framework for building MCP applications. Prior to version 3.2.0, server names containi...

CVE-2025-62801MEDIUM5.4ten sam produkt

FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0, a command-injection...