aa-rag (0.4.3), aden-hive (>=1.0.1, <=1.0.8) +285 more potentially affected by CVE-2025-62801 via fastmcp (>=2.0.0, <=2.12.5)

fastmcp PYPI version =2.0.0, =1.0.1, =1.0.2, =0.5.0, =0.4.6, =1.8.0, =2.0.0.dev1, =2.0.0.dev1, =4.0.0.dev21, =0.0.1, =0.0.2a1, =0.1.0, =0.2.2, =0.7.0, =1.0.0rc2 and more Source cves: CVE-2025-62801 Source advisory: GHSA-RJ5C-58RQ-J5G5...

agentfetch-mcp (>=1.0.0, <=1.0.1), constitute-mcp (>=0.1.18, <=0.1.27) +31 more potentially affected by CVE-2025-62801 via fastmcp (0.4.1)

fastmcp PYPI version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - agentfetch-mcp =1.0.0, =0.1.18, =2.0.2, =1.0.0, =0.1.0, =0.1.41, =1.0.0, =1.0.1 - iflow-mcp-philschmid-code-sandbox-mcp 0.1.0 -...

code-review-graph (>=1.8.0, <=2.2.3.1), iflow-mcp-automateyournetwork-aci-mcp (>=0.1.1, <=0.1.4) +4 more potentially affected by CVE-2025-62801 via fastmcp (1.0.0)

fastmcp PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - code-review-graph =1.8.0, =0.1.1, =0.1.8, =0.1.0, =0.1.0, =0.3.0 - repomind 1.8.4 Source cves: CVE-2025-62801 Source advisory:...

aa-rag (0.4.3), aden-hive (>=1.0.1, <=1.0.8) +285 more potentially affected by CVE-2025-62801 via fastmcp (>=2.0.0, <=2.12.5)

fastmcp PYPI version =2.0.0, =1.0.1, =1.0.2, =0.5.0, =0.4.6, =1.8.0, =2.0.0.dev1, =2.0.0.dev1, =4.0.0.dev21, =0.0.1, =0.0.2a1, =0.1.0, =0.2.2, =0.7.0, =1.0.0rc2 and more Source cves: CVE-2025-62801 Source advisory: OSV:GHSA-RJ5C-58RQ-J5G5...

helm-ai (>=0.1.0, <=0.2.5), iflow-mcp-behinduall-wiki-js-mcp (1.0.0) +4 more potentially affected by CVE-2025-62801 via fastmcp (0.1.0)

fastmcp PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - helm-ai =0.1.0, =0.1.0, =0.1.1, =0.1.12 Source cves: CVE-2025-62801 Source advisory: OSV:GHSA-RJ5C-58RQ-J5G5...

mcp-contract-builder (>=0.0.1, <=0.0.7), mcp-contract-executor (>=0.0.1, <=0.0.7) +2 more potentially affected by CVE-2025-62801 via fastmcp (0.3.5)

fastmcp PYPI version 0.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - mcp-contract-builder =0.0.1, =0.0.1, =0.1.48, =0.1.0, =0.1.3 Source cves: CVE-2025-62801 Source advisory: OSV:GHSA-RJ5C-58RQ-J5G5...

GHSA-RJ5C-58RQ-J5G5 FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name

Summary A command-injection vulnerability lets any attacker who can influence the servername field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor Details 1. generatecursordeeplinkservername, … embeds servername verbatim in a cursor://…?name= query string...

grizabella (>=0.1.0b1, <=0.1.1b1), pypi-query-mcp-server (0.1.0) potentially affected by CVE-2025-62801 via fastmcp (0.2.0)

fastmcp PYPI version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - grizabella =0.1.0b1, =0.1.1b1 - pypi-query-mcp-server 0.1.0 Source cves: CVE-2025-62801 Source advisory: OSV:GHSA-RJ5C-58RQ-J5G5...

FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name

Summary A command-injection vulnerability lets any attacker who can influence the servername field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor Details 1. generatecursordeeplinkservername, … embeds servername verbatim in a cursor://…?name= query string...

EUVD-2025-36567

FastMCP vulnerable to windows command injection in FastMCP Cursor installer via servername...

GHSA-MXXR-JV3V-6PGC FastMCP vulnerable to reflected XSS in client's callback page

Summary While setting up an oauth client, it was noticed that the callback page hosted by the client during the flow embeds user-controlled content without escaping or sanitizing it. This leads to a reflected Cross-Site-Scripting vulnerability. Details The affected code is located in...

code-review-graph (>=1.8.0, <=2.2.3.1), iflow-mcp-automateyournetwork-aci-mcp (>=0.1.1, <=0.1.4) +4 more potentially affected by CVE-2025-62800 via fastmcp (1.0.0)

fastmcp PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - code-review-graph =1.8.0, =0.1.1, =0.1.8, =0.1.0, =0.1.0, =0.3.0 - repomind 1.8.4 Source cves: CVE-2025-62800 Source advisory:...

grizabella (>=0.1.0b1, <=0.1.1b1), pypi-query-mcp-server (0.1.0) potentially affected by CVE-2025-62800 via fastmcp (0.2.0)

fastmcp PYPI version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - grizabella =0.1.0b1, =0.1.1b1 - pypi-query-mcp-server 0.1.0 Source cves: CVE-2025-62800 Source advisory: OSV:GHSA-MXXR-JV3V-6PGC...

aa-rag (0.4.3), aden-hive (>=1.0.1, <=1.0.8) +285 more potentially affected by CVE-2025-62800 via fastmcp (>=2.0.0, <=2.12.5)

fastmcp PYPI version =2.0.0, =1.0.1, =1.0.2, =0.5.0, =0.4.6, =1.8.0, =2.0.0.dev1, =2.0.0.dev1, =4.0.0.dev21, =0.0.1, =0.0.2a1, =0.1.0, =0.2.2, =0.7.0, =1.0.0rc2 and more Source cves: CVE-2025-62800 Source advisory: OSV:GHSA-MXXR-JV3V-6PGC...

EUVD-2025-36568

FastMCP vulnerable to reflected XSS in client's callback page...

FastMCP vulnerable to reflected XSS in client's callback page

Summary While setting up an oauth client, it was noticed that the callback page hosted by the client during the flow embeds user-controlled content without escaping or sanitizing it. This leads to a reflected Cross-Site-Scripting vulnerability. Details The affected code is located in...

agentfetch-mcp (>=1.0.0, <=1.0.1), constitute-mcp (>=0.1.18, <=0.1.27) +31 more potentially affected by CVE-2025-62800 via fastmcp (0.4.1)

fastmcp PYPI version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - agentfetch-mcp =1.0.0, =0.1.18, =2.0.2, =1.0.0, =0.1.0, =0.1.41, =1.0.0, =1.0.1 - iflow-mcp-philschmid-code-sandbox-mcp 0.1.0 -...

helm-ai (>=0.1.0, <=0.2.5), iflow-mcp-behinduall-wiki-js-mcp (1.0.0) +4 more potentially affected by CVE-2025-62800 via fastmcp (0.1.0)

fastmcp PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - helm-ai =0.1.0, =0.1.0, =0.1.1, =0.1.12 Source cves: CVE-2025-62800 Source advisory: OSV:GHSA-MXXR-JV3V-6PGC...

mcp-contract-builder (>=0.0.1, <=0.0.7), mcp-contract-executor (>=0.0.1, <=0.0.7) +2 more potentially affected by CVE-2025-62800 via fastmcp (0.3.5)

fastmcp PYPI version 0.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - mcp-contract-builder =0.0.1, =0.0.1, =0.1.48, =0.1.0, =0.1.3 Source cves: CVE-2025-62800 Source advisory: OSV:GHSA-MXXR-JV3V-6PGC...

aa-rag (0.4.3), aden-hive (>=1.0.1, <=1.0.8) +285 more potentially affected by CVE-2025-62800 via fastmcp (>=2.0.0, <=2.12.5)

fastmcp PYPI version =2.0.0, =1.0.1, =1.0.2, =0.5.0, =0.4.6, =1.8.0, =2.0.0.dev1, =2.0.0.dev1, =4.0.0.dev21, =0.0.1, =0.0.2a1, =0.1.0, =0.2.2, =0.7.0, =1.0.0rc2 and more Source cves: CVE-2025-62800 Source advisory: GHSA-MXXR-JV3V-6PGC...