CVE-2025-62800
NoneFastMCP vulnerable to reflected XSS in client's callback page
CVSS
—
EPSS
0.3%
Published
Oct 29, 2025
CISA due date
—
The record
While setting up an oauth client, it was noticed that the callback page hosted by the client during the flow embeds user-controlled content without escaping or sanitizing it. This leads to a reflected Cross-Site-Scripting vulnerability.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | fastmcp | 0 | 2.13.0 |
Related vulnerabilities
- GHSA-mxxr-jv3v-6pgc FastMCP vulnerable to reflected XSS in client's callback page Same vulnerability
- GHSA-rcfx-77hg-w2wv FastMCP updated to MCP 1.23+ due to CVE-2025-66416 Also affects fastmcp
- GHSA-rj5c-58rq-j5g5 FastMCP vulnerable to windows command injection in FastMCP Cursor installer via… Also affects fastmcp
- GHSA-c2jp-c369-7pvx FastMCP Auth Integration Allows for Confused Deputy Account Takeover Also affects fastmcp
- CVE-2025-62801 FastMCP vulnerable to windows command injection in FastMCP Cursor installer via… Also affects fastmcp
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79