CNNVD-202510-3771 Information
Oct 28, 2025
cve
CNNVD ID
CNNVD-202510-3771
Related CVE
- CNNVD Published: 2025-10-28
Description (Chinese)
FastMCP是Jeremiah Lowin个人开发者的一个MCP服务器构建软件。 FastMCP 2.13.0之前版本存在跨站脚本漏洞，该漏洞源于OAuth客户端回调页面未转义用户控制值，可能导致反射型跨站脚本攻击。
Description (English)
FastMCP is an MCP server builder for Jeremiah Lowin, a personal developer. The pre-FastMCP version 2.1.3.0 has a cross-site script loophole, which results from the failure of the OAuth client to convert the user control value to a user control value, which may result in a reflex-type cross-site script attack.
Hazard Level
High
Vulnerability Type
跨站脚本
Affected Vendor
个人开发者
Published
2025-10-28
Last Modified
2026-02-24
References
https://github.com/jlowin/fastmcp/security/advisories/GHSA-mxxr-jv3v-6pgc https://access.redhat.com/security/cve/cve-2025-62800
Patch
https://github.com/jlowin/fastmcp/releases
Share on: