aa-rag (0.4.3), aden-hive (>=1.0.1, <=1.0.8) +285 more potentially affected by CVE-2025-62800 via fastmcp (>=2.0.0, <=2.12.5)

fastmcp PYPI version =2.0.0, =1.0.1, =1.0.2, =0.5.0, =0.4.6, =1.8.0, =2.0.0.dev1, =2.0.0.dev1, =4.0.0.dev21, =0.0.1, =0.0.2a1, =0.1.0, =0.2.2, =0.7.0, =1.0.0rc2 and more Source cves: CVE-2025-62800 Source advisory: OSV:PYSEC-2026-1364...

grizabella (>=0.1.0b1, <=0.1.1b1), pypi-query-mcp-server (0.1.0) potentially affected by CVE-2025-62801 via fastmcp (0.2.0)

fastmcp PYPI version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - grizabella =0.1.0b1, =0.1.1b1 - pypi-query-mcp-server 0.1.0 Source cves: CVE-2025-62801 Source advisory: OSV:PYSEC-2026-1365...

grizabella (>=0.1.0b1, <=0.1.1b1), pypi-query-mcp-server (0.1.0) potentially affected by CVE-2025-62800 via fastmcp (0.2.0)

fastmcp PYPI version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - grizabella =0.1.0b1, =0.1.1b1 - pypi-query-mcp-server 0.1.0 Source cves: CVE-2025-62800 Source advisory: OSV:PYSEC-2026-1364...

code-review-graph (>=1.8.0, <=2.2.3.1), iflow-mcp-automateyournetwork-aci-mcp (>=0.1.1, <=0.1.4) +4 more potentially affected by CVE-2025-62801 via fastmcp (1.0.0)

fastmcp PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - code-review-graph =1.8.0, =0.1.1, =0.1.8, =0.1.0, =0.1.0, =0.3.0 - repomind 1.8.4 Source cves: CVE-2025-62801 Source advisory: OSV:PYSEC-2026-1365...

aa-rag (0.4.3), aden-hive (>=1.0.1, <=1.0.8) +285 more potentially affected by CVE-2025-62801 via fastmcp (>=2.0.0, <=2.12.5)

fastmcp PYPI version =2.0.0, =1.0.1, =1.0.2, =0.5.0, =0.4.6, =1.8.0, =2.0.0.dev1, =2.0.0.dev1, =4.0.0.dev21, =0.0.1, =0.0.2a1, =0.1.0, =0.2.2, =0.7.0, =1.0.0rc2 and more Source cves: CVE-2025-62801 Source advisory: OSV:PYSEC-2026-1365...

FastMCP vulnerable to reflected XSS in client's callback page

SummaryWhile setting up an oauth client, it was noticed that the callback page hosted by the client during the flow embeds user-controlled content without escaping or sanitizing it. This leads to a reflected Cross-Site-Scripting vulnerability. DetailsThe affected code is located in...

mcp-contract-builder (>=0.0.1, <=0.0.7), mcp-contract-executor (>=0.0.1, <=0.0.7) +2 more potentially affected by CVE-2025-62801 via fastmcp (0.3.5)

fastmcp PYPI version 0.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - mcp-contract-builder =0.0.1, =0.0.1, =0.1.48, =0.1.0, =0.1.3 Source cves: CVE-2025-62801 Source advisory: OSV:PYSEC-2026-1365...

helm-ai (>=0.1.0, <=0.2.5), iflow-mcp-behinduall-wiki-js-mcp (1.0.0) +4 more potentially affected by CVE-2025-62801 via fastmcp (0.1.0)

fastmcp PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - helm-ai =0.1.0, =0.1.0, =0.1.1, =0.1.12 Source cves: CVE-2025-62801 Source advisory: OSV:PYSEC-2026-1365...

agentfetch-mcp (>=1.0.0, <=1.0.1), constitute-mcp (>=0.1.18, <=0.1.27) +31 more potentially affected by CVE-2025-62801 via fastmcp (0.4.1)

fastmcp PYPI version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - agentfetch-mcp =1.0.0, =0.1.18, =2.0.2, =1.0.0, =0.1.0, =0.1.41, =1.0.0, =1.0.1 - iflow-mcp-philschmid-code-sandbox-mcp 0.1.0 -...

PYSEC-2026-1365 FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name

Summary A command-injection vulnerability lets any attacker who can influence the servername field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor Details 1. generatecursordeeplinkservername, … embeds servername verbatim in a cursor://…?name= query string...

mcp-contract-builder (>=0.0.1, <=0.0.7), mcp-contract-executor (>=0.0.1, <=0.0.7) +2 more potentially affected by CVE-2025-62800 via fastmcp (0.3.5)

fastmcp PYPI version 0.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - mcp-contract-builder =0.0.1, =0.0.1, =0.1.48, =0.1.0, =0.1.3 Source cves: CVE-2025-62800 Source advisory: OSV:PYSEC-2026-1364...

MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoS

A validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability 500 errors until manually restarted. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures.Thank yo...

ariadne-sensemaking (>=0.1.0, <=0.1.2), atlan-mcp-server (0.3.1) +5 more potentially affected by CVE-2026-32871 via fastmcp (2.13.2)

fastmcp PYPI version 2.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - ariadne-sensemaking =0.1.0, =1.0.35, =0.5.33, =0.5.34 Source cves: CVE-2026-32871 Source advisory: OSV:PYSEC-2026-338...

beads-mcp (>=0.49.2, <=0.49.6), callmymcp (1.0.0) +5 more potentially affected by CVE-2026-32871 via fastmcp (2.14.4)

fastmcp PYPI version 2.14.4 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - beads-mcp =0.49.2, =0.0.1, =0.2.7, =0.2.8 - upstock-mcp 2.2.0 Source cves: CVE-2026-32871 Source advisory: OSV:PYSEC-2026-338...

vail-model-registry (>=0.1.11, <=0.1.12) potentially affected by CVE-2026-32871 via fastmcp (2.10.0)

fastmcp PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - vail-model-registry =0.1.11, =0.1.12 Source cves: CVE-2026-32871 Source advisory: OSV:PYSEC-2026-338...

ai-application-gateway (>=0.1.1, <=0.1.5), ai-universe-mail (>=0.1.0, <=0.1.1) +28 more potentially affected by CVE-2026-32871 via fastmcp (2.13.0.2)

fastmcp PYPI version 2.13.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - ai-application-gateway =0.1.1, =0.1.0, =0.2.11, =0.21.6, =0.1.5, =0.1.0, =0.0.92, =0.4.4, =0.4.0, =0.1.5, =1.0.0, =1.0.0, =1.0.1 -...

agent-mcp-server (0.0.4.0), beads-mcp (>=0.30.1, <=0.47.1) +10 more potentially affected by CVE-2026-32871 via fastmcp (2.14.1)

fastmcp PYPI version 2.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - agent-mcp-server 0.0.4.0 - beads-mcp =0.30.1, =1.36.5, =0.2.0, =0.0.3, =0.11.0, =0.1.14, =8.5.0, =0.3.1, =0.2.0, =0.2.6 Source cves: CVE-2026-328...

alation-ai-agent-mcp (1.0.0rc3), codesecure-mcp (1.0.0b9) +4 more potentially affected by CVE-2026-32871 via fastmcp (2.14.0)

fastmcp PYPI version 2.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - alation-ai-agent-mcp 1.0.0rc3 - codesecure-mcp 1.0.0b9 - korean-stat-mcp 0.1.4 - mcp-proxy-for-aws =1.1.5, =0.3.0, =0.5.0 - seclab-taskflow-agent...

complexipy-mcp (>=0.1.0, <=0.1.1), gyy-mcp (>=1.0.0, <=1.1.2) +19 more potentially affected by CVE-2026-32871 via fastmcp (2.14.2)

fastmcp PYPI version 2.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - complexipy-mcp =0.1.0, =1.0.0, =1.1.2 - oracle-oci-cloud-guard-mcp-server 1.1.2 - oracle-oci-cloud-mcp-server 1.1.2 -...

beads-mcp (>=0.47.2, <=0.49.1), fs-mcp (>=1.6.0, <=1.47.3) +4 more potentially affected by CVE-2026-32871 via fastmcp (2.14.3)

fastmcp PYPI version 2.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - beads-mcp =0.47.2, =1.6.0, =1.0.0, =1.0.1, =0.2.5, =0.2.6 - zap-ai 0.4.0 Source cves: CVE-2026-32871 Source advisory: OSV:PYSEC-2026-338...