jlowin/fastmcp Security Advisories | GitStock

high2025-12-26

FastMCP updated to MCP 1.23+ due to CVE-2025-66416

GHSA-rcfx-77hg-w2wv

medium2025-10-29

FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name

GHSA-rj5c-58rq-j5g5 · CVE-2025-62801

medium2025-10-29

FastMCP vulnerable to reflected XSS in client's callback page

GHSA-mxxr-jv3v-6pgc · CVE-2025-62800

high2025-10-29

FastMCP Auth Integration Allows for Confused Deputy Account Takeover

GHSA-c2jp-c369-7pvx