Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/fastmcp@2.2.1
Typepypi
Namespace
Namefastmcp
Version2.2.1
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version3.2.0
Latest_non_vulnerable_version3.2.0
Affected_by_vulnerabilities
0
url VCID-1u8g-rwag-kyh8
vulnerability_id VCID-1u8g-rwag-kyh8
summary FastMCP is the standard framework for building MCP applications. Prior to version 3.2.0, while testing the GitHubProvider OAuth integration, which allows authentication to a FastMCP MCP server via a FastMCP OAuthProxy using GitHub OAuth, it was discovered that the FastMCP OAuthProxy does not properly validate the user's consent upon receiving the authorization code from GitHub. In combination with GitHub’s behavior of skipping the consent page for previously authorized clients, this introduces a Confused Deputy vulnerability. This issue has been patched in version 3.2.0.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-27124.json
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-27124.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-27124
reference_id
reference_type
scores
0
value 0.00068
scoring_system epss
scoring_elements 0.21194
published_at 2026-06-14T12:55:00Z
1
value 0.00068
scoring_system epss
scoring_elements 0.21018
published_at 2026-06-11T12:55:00Z
2
value 0.00068
scoring_system epss
scoring_elements 0.21214
published_at 2026-06-13T12:55:00Z
3
value 0.00068
scoring_system epss
scoring_elements 0.21197
published_at 2026-06-12T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-27124
2
reference_url https://github.com/jlowin/fastmcp/security/advisories/GHSA-rww4-4w9c-7733
reference_id
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
1
value 8.2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/jlowin/fastmcp/security/advisories/GHSA-rww4-4w9c-7733
3
reference_url https://github.com/PrefectHQ/fastmcp
reference_id
reference_type
scores
0
value 8.2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/PrefectHQ/fastmcp
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-27124
reference_id
reference_type
scores
0
value 8.2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-27124
5
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2454826
reference_id 2454826
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2454826
6
reference_url https://github.com/advisories/GHSA-rww4-4w9c-7733
reference_id GHSA-rww4-4w9c-7733
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-rww4-4w9c-7733
7
reference_url https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-rww4-4w9c-7733
reference_id GHSA-rww4-4w9c-7733
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
1
value 8.2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-03T16:44:15Z/
url https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-rww4-4w9c-7733
fixed_packages
0
url pkg:pypi/fastmcp@3.2.0
purl pkg:pypi/fastmcp@3.2.0
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/fastmcp@3.2.0
aliases CVE-2026-27124, GHSA-rww4-4w9c-7733
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-1u8g-rwag-kyh8
1
url VCID-43p7-aggk-9bbv
vulnerability_id VCID-43p7-aggk-9bbv
summary FastMCP Auth Integration Allows for Confused Deputy Account Takeover
references
0
reference_url https://github.com/jlowin/fastmcp
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/jlowin/fastmcp
1
reference_url https://github.com/advisories/GHSA-c2jp-c369-7pvx
reference_id GHSA-c2jp-c369-7pvx
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-c2jp-c369-7pvx
2
reference_url https://github.com/jlowin/fastmcp/security/advisories/GHSA-c2jp-c369-7pvx
reference_id GHSA-c2jp-c369-7pvx
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
1
value 7.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/jlowin/fastmcp/security/advisories/GHSA-c2jp-c369-7pvx
fixed_packages
0
url pkg:pypi/fastmcp@2.13.0
purl pkg:pypi/fastmcp@2.13.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1u8g-rwag-kyh8
1
vulnerability VCID-9b9j-ag4r-37cb
2
vulnerability VCID-da8h-ecw8-dbgj
3
vulnerability VCID-g6un-1s82-cyah
4
vulnerability VCID-sfb2-vyg6-gqar
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/fastmcp@2.13.0
aliases GHSA-c2jp-c369-7pvx
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-43p7-aggk-9bbv
2
url VCID-9b9j-ag4r-37cb
vulnerability_id VCID-9b9j-ag4r-37cb
summary FastMCP is a Pythonic way to build MCP servers and clients. Prior to version 3.2.0, the OpenAPIProvider in FastMCP exposes internal APIs to MCP clients by parsing OpenAPI specifications. The RequestDirector class is responsible for constructing HTTP requests to the backend service. A vulnerability exists in the _build_url() method. When an OpenAPI operation defines path parameters (e.g., /api/v1/users/{user_id}), the system directly substitutes parameter values into the URL template string without URL-encoding. Subsequently, urllib.parse.urljoin() resolves the final URL. Since urljoin() interprets ../ sequences as directory traversal, an attacker controlling a path parameter can perform path traversal attacks to escape the intended API prefix and access arbitrary backend endpoints. This results in authenticated SSRF, as requests are sent with the authorization headers configured in the MCP provider. This issue has been patched in version 3.2.0.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-32871.json
reference_id
reference_type
scores
0
value 8.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-32871.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-32871
reference_id
reference_type
scores
0
value 0.00066
scoring_system epss
scoring_elements 0.20797
published_at 2026-06-13T12:55:00Z
1
value 0.00066
scoring_system epss
scoring_elements 0.20775
published_at 2026-06-14T12:55:00Z
2
value 0.00066
scoring_system epss
scoring_elements 0.20598
published_at 2026-06-11T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-32871
2
reference_url https://github.com/PrefectHQ/fastmcp
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
1
value 10.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/PrefectHQ/fastmcp
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-32871
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
1
value 10.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-32871
4
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2454434
reference_id 2454434
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2454434
5
reference_url https://github.com/PrefectHQ/fastmcp/pull/3507
reference_id 3507
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
1
value 10
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
2
value 10.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
3
value CRITICAL
scoring_system generic_textual
scoring_elements
4
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2026-04-02T15:59:21Z/
url https://github.com/PrefectHQ/fastmcp/pull/3507
6
reference_url https://github.com/PrefectHQ/fastmcp/commit/40bdfb6b1de0ce30609ee9ba5bb95ecd04a9fb71
reference_id 40bdfb6b1de0ce30609ee9ba5bb95ecd04a9fb71
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
1
value 10
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
2
value 10.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
3
value CRITICAL
scoring_system generic_textual
scoring_elements
4
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2026-04-02T15:59:21Z/
url https://github.com/PrefectHQ/fastmcp/commit/40bdfb6b1de0ce30609ee9ba5bb95ecd04a9fb71
7
reference_url https://github.com/advisories/GHSA-vv7q-7jx5-f767
reference_id GHSA-vv7q-7jx5-f767
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-vv7q-7jx5-f767
8
reference_url https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-vv7q-7jx5-f767
reference_id GHSA-vv7q-7jx5-f767
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
1
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
2
value 10
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
3
value 10.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
4
value CRITICAL
scoring_system generic_textual
scoring_elements
5
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2026-04-02T15:59:21Z/
url https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-vv7q-7jx5-f767
9
reference_url https://github.com/PrefectHQ/fastmcp/releases/tag/v3.2.0
reference_id v3.2.0
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
1
value 10
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
2
value 10.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
3
value CRITICAL
scoring_system generic_textual
scoring_elements
4
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2026-04-02T15:59:21Z/
url https://github.com/PrefectHQ/fastmcp/releases/tag/v3.2.0
fixed_packages
0
url pkg:pypi/fastmcp@3.2.0
purl pkg:pypi/fastmcp@3.2.0
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/fastmcp@3.2.0
aliases CVE-2026-32871, GHSA-vv7q-7jx5-f767
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-9b9j-ag4r-37cb
3
url VCID-da8h-ecw8-dbgj
vulnerability_id VCID-da8h-ecw8-dbgj
summary FastMCP is the standard framework for building MCP applications. Prior to version 3.2.0, server names containing shell metacharacters (e.g., &) can cause command injection on Windows when passed to fastmcp install claude-code or fastmcp install gemini-cli. These install paths use subprocess.run() with a list argument, but on Windows the target CLIs often resolve to .cmd wrappers that are executed through cmd.exe, which interprets metacharacters in the flattened command string. This issue has been patched in version 3.2.0.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-64340
reference_id
reference_type
scores
0
value 8e-05
scoring_system epss
scoring_elements 0.0082
published_at 2026-06-13T12:55:00Z
1
value 8e-05
scoring_system epss
scoring_elements 0.00823
published_at 2026-06-14T12:55:00Z
2
value 8e-05
scoring_system epss
scoring_elements 0.00817
published_at 2026-06-12T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-64340
1
reference_url https://github.com/jlowin/fastmcp/security/advisories/GHSA-m8x7-r2rg-vh5g
reference_id
reference_type
scores
0
value 6.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/jlowin/fastmcp/security/advisories/GHSA-m8x7-r2rg-vh5g
2
reference_url https://github.com/PrefectHQ/fastmcp
reference_id
reference_type
scores
0
value 6.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/PrefectHQ/fastmcp
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-64340
reference_id
reference_type
scores
0
value 6.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-64340
4
reference_url https://github.com/PrefectHQ/fastmcp/pull/3522
reference_id 3522
reference_type
scores
0
value 6.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-04-03T16:11:50Z/
url https://github.com/PrefectHQ/fastmcp/pull/3522
5
reference_url https://github.com/advisories/GHSA-m8x7-r2rg-vh5g
reference_id GHSA-m8x7-r2rg-vh5g
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-m8x7-r2rg-vh5g
6
reference_url https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-m8x7-r2rg-vh5g
reference_id GHSA-m8x7-r2rg-vh5g
reference_type
scores
0
value 6.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-04-03T16:11:50Z/
url https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-m8x7-r2rg-vh5g
fixed_packages
0
url pkg:pypi/fastmcp@3.2.0
purl pkg:pypi/fastmcp@3.2.0
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/fastmcp@3.2.0
aliases CVE-2025-64340, GHSA-m8x7-r2rg-vh5g
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-da8h-ecw8-dbgj
4
url VCID-g6un-1s82-cyah
vulnerability_id VCID-g6un-1s82-cyah
summary FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for the MCP server, the token is issued for the base_url passed to the OAuthProxy during initialization. This issue has been patched 2.14.2.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-69196.json
reference_id
reference_type
scores
0
value 7.4
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-69196.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-69196
reference_id
reference_type
scores
0
value 0.00022
scoring_system epss
scoring_elements 0.06373
published_at 2026-06-14T12:55:00Z
1
value 0.00022
scoring_system epss
scoring_elements 0.06385
published_at 2026-06-11T12:55:00Z
2
value 0.00022
scoring_system epss
scoring_elements 0.06395
published_at 2026-06-13T12:55:00Z
3
value 0.00022
scoring_system epss
scoring_elements 0.06406
published_at 2026-06-12T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-69196
2
reference_url https://github.com/PrefectHQ/fastmcp
reference_id
reference_type
scores
0
value 7.4
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/PrefectHQ/fastmcp
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-69196
reference_id
reference_type
scores
0
value 7.4
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-69196
4
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2448179
reference_id 2448179
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2448179
5
reference_url https://github.com/advisories/GHSA-5h2m-4q8j-pqpj
reference_id GHSA-5h2m-4q8j-pqpj
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-5h2m-4q8j-pqpj
6
reference_url https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-5h2m-4q8j-pqpj
reference_id GHSA-5h2m-4q8j-pqpj
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
1
value 7.4
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-16T19:09:19Z/
url https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-5h2m-4q8j-pqpj
fixed_packages
0
url pkg:pypi/fastmcp@2.14.2
purl pkg:pypi/fastmcp@2.14.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1u8g-rwag-kyh8
1
vulnerability VCID-9b9j-ag4r-37cb
2
vulnerability VCID-da8h-ecw8-dbgj
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/fastmcp@2.14.2
aliases CVE-2025-69196, GHSA-5h2m-4q8j-pqpj
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-g6un-1s82-cyah
5
url VCID-jvab-ff2e-pkde
vulnerability_id VCID-jvab-ff2e-pkde
summary FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0, a command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor. This vulnerability is fixed in 2.13.0.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-62801
reference_id
reference_type
scores
0
value 0.00049
scoring_system epss
scoring_elements 0.15852
published_at 2026-06-13T12:55:00Z
1
value 0.00049
scoring_system epss
scoring_elements 0.15819
published_at 2026-06-14T12:55:00Z
2
value 0.00049
scoring_system epss
scoring_elements 0.15839
published_at 2026-06-12T12:55:00Z
3
value 0.00049
scoring_system epss
scoring_elements 0.15699
published_at 2026-06-11T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-62801
1
reference_url https://github.com/jlowin/fastmcp
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/jlowin/fastmcp
2
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-62801
reference_id CVE-2025-62801
reference_type
scores
0
value 5.4
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-62801
3
reference_url https://github.com/advisories/GHSA-rj5c-58rq-j5g5
reference_id GHSA-rj5c-58rq-j5g5
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-rj5c-58rq-j5g5
4
reference_url https://github.com/jlowin/fastmcp/security/advisories/GHSA-rj5c-58rq-j5g5
reference_id GHSA-rj5c-58rq-j5g5
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
1
value 5.4
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-10-29T14:54:52Z/
url https://github.com/jlowin/fastmcp/security/advisories/GHSA-rj5c-58rq-j5g5
fixed_packages
0
url pkg:pypi/fastmcp@2.13.0
purl pkg:pypi/fastmcp@2.13.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1u8g-rwag-kyh8
1
vulnerability VCID-9b9j-ag4r-37cb
2
vulnerability VCID-da8h-ecw8-dbgj
3
vulnerability VCID-g6un-1s82-cyah
4
vulnerability VCID-sfb2-vyg6-gqar
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/fastmcp@2.13.0
aliases CVE-2025-62801, GHSA-rj5c-58rq-j5g5
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-jvab-ff2e-pkde
6
url VCID-knum-w95g-g7es
vulnerability_id VCID-knum-w95g-g7es
summary FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0 have a reflected cross-site scripting vulnerability in the OAuth client callback page (oauth_callback.py) where unescaped user-controlled values are inserted into the generated HTML, allowing arbitrary JavaScript execution in the callback server origin. The issue is fixed in version 2.13.0.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-62800
reference_id
reference_type
scores
0
value 0.00059
scoring_system epss
scoring_elements 0.18865
published_at 2026-06-11T12:55:00Z
1
value 0.00059
scoring_system epss
scoring_elements 0.19026
published_at 2026-06-14T12:55:00Z
2
value 0.00059
scoring_system epss
scoring_elements 0.19048
published_at 2026-06-13T12:55:00Z
3
value 0.00059
scoring_system epss
scoring_elements 0.1903
published_at 2026-06-12T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-62800
1
reference_url https://github.com/jlowin/fastmcp
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/jlowin/fastmcp
2
reference_url https://github.com/jlowin/fastmcp/commit/2a20f54617a37213ed83894a8c2f0ac38a2e83a3
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/jlowin/fastmcp/commit/2a20f54617a37213ed83894a8c2f0ac38a2e83a3
3
reference_url https://github.com/jlowin/fastmcp/pull/2090
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/jlowin/fastmcp/pull/2090
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-62800
reference_id CVE-2025-62800
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-62800
5
reference_url https://github.com/advisories/GHSA-mxxr-jv3v-6pgc
reference_id GHSA-mxxr-jv3v-6pgc
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-mxxr-jv3v-6pgc
6
reference_url https://github.com/jlowin/fastmcp/security/advisories/GHSA-mxxr-jv3v-6pgc
reference_id GHSA-mxxr-jv3v-6pgc
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
1
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-29T15:52:40Z/
url https://github.com/jlowin/fastmcp/security/advisories/GHSA-mxxr-jv3v-6pgc
fixed_packages
0
url pkg:pypi/fastmcp@2.13.0
purl pkg:pypi/fastmcp@2.13.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1u8g-rwag-kyh8
1
vulnerability VCID-9b9j-ag4r-37cb
2
vulnerability VCID-da8h-ecw8-dbgj
3
vulnerability VCID-g6un-1s82-cyah
4
vulnerability VCID-sfb2-vyg6-gqar
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/fastmcp@2.13.0
aliases CVE-2025-62800, GHSA-mxxr-jv3v-6pgc
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-knum-w95g-g7es
7
url VCID-sfb2-vyg6-gqar
vulnerability_id VCID-sfb2-vyg6-gqar
summary FastMCP updated to MCP 1.23+ due to CVE-2025-66416
references
0
reference_url https://github.com/jlowin/fastmcp
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/jlowin/fastmcp
1
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-66416
reference_id CVE-2025-66416
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-66416
2
reference_url https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-9h52-p55h-vw2f
reference_id GHSA-9h52-p55h-vw2f
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-9h52-p55h-vw2f
3
reference_url https://github.com/advisories/GHSA-rcfx-77hg-w2wv
reference_id GHSA-rcfx-77hg-w2wv
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-rcfx-77hg-w2wv
4
reference_url https://github.com/jlowin/fastmcp/security/advisories/GHSA-rcfx-77hg-w2wv
reference_id GHSA-rcfx-77hg-w2wv
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/jlowin/fastmcp/security/advisories/GHSA-rcfx-77hg-w2wv
fixed_packages
0
url pkg:pypi/fastmcp@2.14.0
purl pkg:pypi/fastmcp@2.14.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1u8g-rwag-kyh8
1
vulnerability VCID-9b9j-ag4r-37cb
2
vulnerability VCID-da8h-ecw8-dbgj
3
vulnerability VCID-g6un-1s82-cyah
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/fastmcp@2.14.0
aliases GHSA-rcfx-77hg-w2wv
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-sfb2-vyg6-gqar
Fixing_vulnerabilities
Risk_score4.5
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/fastmcp@2.2.1