Executive brief
FastMCP vulnerable to reflected XSS in client's callback page
Affected products
- PyPI fastmcp
Junglewise Threat Intelligence
CVE-2025-62800: PYSEC-2026-1364 - FastMCP vulnerable to reflected XSS in client's callback page
CVE-2025-62800 · Severity: medium · CVSS 4 · Published 2026-07-07
Technologies: fastmcp (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1365 - FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name
- FastMCP confused deputy vulnerability in OAuthProxy callback
- PrefectHQ FastMCP command injection in CLI install on Windows
- PrefectHQ FastMCP path traversal and SSRF in OpenAPIProvider
- PrefectHQ FastMCP improper resource handling in OAuth Proxy