Skip to content
OpenAdvisories

Vendor

jlowin

5 known vulnerabilities.

jlowin at a glance

Last 12 months
3
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 1 vulnerability Mar April 2026: 2 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202620
Mar 202610
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202520
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

fastmcp 5
All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • High 8.2
    CVE-2026-27124

    FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities

    FastMCP is the standard framework for building MCP applications. Prior to version 3.2.0, while testing the GitHubProvider OAuth integration, which allows authentication to a FastMCP MCP server via a FastMCP OAuthProxy using GitHub OAuth, it was discovered tha…

    jlowin fastmcp fastmcp PyPI
  • Medium 6.7
    CVE-2025-64340

    FastMCP has a Command Injection vulnerability - Gemini CLI

    FastMCP is the standard framework for building MCP applications. Prior to version 3.2.0, server names containing shell metacharacters (e.g., &) can cause command injection on Windows when passed to fastmcp install claude-code or fastmcp install gemini-cli. Th…

    jlowin fastmcp fastmcp PyPI
  • High 7.4
    CVE-2025-69196

    FastMCP OAuth Proxy token reuse across MCP servers

    FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for t…

    jlowin fastmcp fastmcp PyPI
  • Medium 5.4
    CVE-2025-62801

    FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name

    FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0, a command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp in…

    jlowin fastmcp fastmcp PyPI
  • Medium 5.3
    CVE-2025-62800

    FastMCP vulnerable to reflected XSS in client's callback page

    FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0 have a reflected cross-site scripting vulnerability in the OAuth client callback page (oauth_callback.py) where unescaped user-controlled values are inserted into the ge…

    jlowin fastmcp fastmcp PyPI