Homepage

fastmcp@2.11.0 vulnerabilities

The fast, Pythonic way to build MCP servers and clients.

  • latest version

    2.13.0.2

  • latest non vulnerable version

    2.13.0.2

  • first published

    11 months ago

  • latest version published

    9 days ago

  • licenses detected

  • View fastmcp package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the fastmcp package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Command Injection

    fastmcp is a The fast, Pythonic way to build MCP servers and clients.

    Affected versions of this package are vulnerable to Command Injection via the server_name field. An attacker can execute arbitrary OS commands by supplying crafted input to this field during the installation process on Windows hosts that run the install cursor functionality.

    How to fix Command Injection?

    Upgrade fastmcp to version 2.13.0rc1 or higher.

    [,2.13.0rc1)
    • H
    Unintended Proxy or Intermediary ('Confused Deputy')

    fastmcp is a The fast, Pythonic way to build MCP servers and clients.

    Affected versions of this package are vulnerable to Unintended Proxy or Intermediary ('Confused Deputy') during the authentication with OAuth providers that don't support Dynamic Client Registration (DCR). An attacker can gain unauthorized access to user accounts by tricking authenticated users into clicking a crafted authorization link for a malicious client, which leverages existing consent and browser state to obtain an authorization code for the attacker's client, allowing them to impersonate the victim.

    How to fix Unintended Proxy or Intermediary ('Confused Deputy')?

    Upgrade fastmcp to version 2.13.0 or higher.

    [,2.13.0)
    • M
    Cross-site Scripting (XSS)

    fastmcp is a The fast, Pythonic way to build MCP servers and clients.

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the create_callback_html() function. An attacker can execute arbitrary JavaScript in the context of the callback server's origin by supplying crafted message that is reflected in the generated HTML.

    How to fix Cross-site Scripting (XSS)?

    Upgrade fastmcp to version 2.13.0 or higher.

    [,2.13.0)
    Go back to all versions of this package