GHSA-mxxr-jv3v-6pgc
NoneCVSS
—
EPSS
—
Published
Oct 29, 2025
CISA due date
—
The record
FastMCP vulnerable to reflected XSS in client's callback page
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | fastmcp | 0 | 2.13.0 |
Related vulnerabilities
- CVE-2025-62800 FastMCP vulnerable to reflected XSS in client's callback page Same vulnerability
- GHSA-rcfx-77hg-w2wv FastMCP updated to MCP 1.23+ due to CVE-2025-66416 Also affects fastmcp
- GHSA-rj5c-58rq-j5g5 FastMCP vulnerable to windows command injection in FastMCP Cursor installer via… Also affects fastmcp
- GHSA-c2jp-c369-7pvx FastMCP Auth Integration Allows for Confused Deputy Account Takeover Also affects fastmcp
- CVE-2025-62801 FastMCP vulnerable to windows command injection in FastMCP Cursor installer via… Also affects fastmcp
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79