Skip to content
OpenAdvisories

Vendor

jlowin

5 known vulnerabilities.

Products

fastmcp 5
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.7
    CVE-2025-64340

    FastMCP has a Command Injection vulnerability - Gemini CLI

    FastMCP is the standard framework for building MCP applications. Prior to version 3.2.0, server names containing shell metacharacters (e.g., &) can cause command injection on Windows when passed to fastmcp install claude-code or fastmcp install gemini-cli. Th…

    jlowin fastmcp fastmcp PyPI
  • Medium 5.4
    CVE-2025-62801

    FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name

    FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0, a command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp in…

    jlowin fastmcp fastmcp PyPI
  • Medium 5.3
    CVE-2025-62800

    FastMCP vulnerable to reflected XSS in client's callback page

    FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0 have a reflected cross-site scripting vulnerability in the OAuth client callback page (oauth_callback.py) where unescaped user-controlled values are inserted into the ge…

    jlowin fastmcp fastmcp PyPI