PyPI: fastmcp
CVE-2025-62800
Safety vulnerability ID: SFTY-20251029-10561
Safety legacy ID: pyup.io-80983
Affected versions of the fastmcp package are vulnerable to Cross-site Scripting (XSS) due to unsanitized user-controlled content being embedded in the OAuth client’s callback HTML. The create_callback_html function in src/fastmcp/client/oauth_callback.py inserts the message parameter—including values propagated from query parameters such as error—directly into the page without HTML escaping, enabling reflected XSS.
Overview
FastMCP vulnerable to reflected XSS in client's callback page
Advisory
Affected versions of the fastmcp package are vulnerable to Cross-site Scripting (XSS) due to unsanitized user-controlled content being embedded in the OAuth client’s callback HTML. The create_callback_html function in src/fastmcp/client/oauth_callback.py inserts the message parameter—including values propagated from query parameters such as error—directly into the page without HTML escaping, enabling reflected XSS.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20251029-10561/CVE-2025-62800
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-62800
- https://github.com/advisories/GHSA-mxxr-jv3v-6pgc
- https://github.com/jlowin/fastmcp/security/advisories/GHSA-mxxr-jv3v-6pgc
- https://nvd.nist.gov/vuln/detail/CVE-2025-62800
- https://github.com/jlowin/fastmcp/pull/2090
- https://github.com/jlowin/fastmcp/commit/2a20f54617a37213ed83894a8c2f0ac38a2e83a3
- https://github.com/advisories/GHSA-mxxr-jv3v-6pgc
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more