Fastmcp
Monthly
OS command injection in FastMCP versions prior to 2.13.0 allows an attacker who can influence the server_name field of an MCP server to run arbitrary operating-system commands on Windows hosts where the victim executes `fastmcp install cursor`. Exploitation is gated by three prerequisites that must all hold: the host must be Windows (the shell invocation is compiled in only on that platform), the victim must run the Cursor installer command, and the attacker must control or influence the server_name value of the MCP being installed - usually via a shared, published, or otherwise attacker-supplied MCP server. The flaw is fixed in FastMCP 2.13.0; publicly available exploit code exists, but CISA KEV does not list it as actively exploited, EPSS is low at 0.23% (12th percentile), and the assessed impact requires user interaction (CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), making this a genuine but gated code-execution issue rather than a mass-exploitation emergency.
Reflected cross-site scripting in FastMCP versions prior to 2.13.0 lets an attacker execute arbitrary JavaScript in the origin of the local OAuth callback server that the FastMCP client spins up during an authorization flow. The flaw is in the client's callback page, where the message argument passed to create_callback_html - including values taken directly from GET parameters such as error - is inserted into the returned HTML without escaping; a crafted callback URL such as http://localhost:1337/callback?error=<img/src/onerror=alert(window.origin)> triggers script execution in the victim's browser. Publicly available exploit code exists (the advisory itself documents a PoC), but there is no CISA KEV entry indicating confirmed active exploitation, and EPSS is low at 0.28% (18th percentile), consistent with a genuine but moderate-severity issue rather than a top-tier priority. Exploitation requires the victim to be running an affected OAuth client with its callback server actively listening during an in-progress authorization flow, and requires user interaction (UI:P) - typically luring the user to a malicious callback URL or using a malicious/compromised authorization server that returns the exploit URL in the authorization_endpoint field so the client opens it automatically; no authentication is required (PR:N).
OS command injection in FastMCP versions prior to 2.13.0 allows an attacker who can influence the server_name field of an MCP server to run arbitrary operating-system commands on Windows hosts where the victim executes `fastmcp install cursor`. Exploitation is gated by three prerequisites that must all hold: the host must be Windows (the shell invocation is compiled in only on that platform), the victim must run the Cursor installer command, and the attacker must control or influence the server_name value of the MCP being installed - usually via a shared, published, or otherwise attacker-supplied MCP server. The flaw is fixed in FastMCP 2.13.0; publicly available exploit code exists, but CISA KEV does not list it as actively exploited, EPSS is low at 0.23% (12th percentile), and the assessed impact requires user interaction (CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), making this a genuine but gated code-execution issue rather than a mass-exploitation emergency.
Reflected cross-site scripting in FastMCP versions prior to 2.13.0 lets an attacker execute arbitrary JavaScript in the origin of the local OAuth callback server that the FastMCP client spins up during an authorization flow. The flaw is in the client's callback page, where the message argument passed to create_callback_html - including values taken directly from GET parameters such as error - is inserted into the returned HTML without escaping; a crafted callback URL such as http://localhost:1337/callback?error=<img/src/onerror=alert(window.origin)> triggers script execution in the victim's browser. Publicly available exploit code exists (the advisory itself documents a PoC), but there is no CISA KEV entry indicating confirmed active exploitation, and EPSS is low at 0.28% (18th percentile), consistent with a genuine but moderate-severity issue rather than a top-tier priority. Exploitation requires the victim to be running an affected OAuth client with its callback server actively listening during an in-progress authorization flow, and requires user interaction (UI:P) - typically luring the user to a malicious callback URL or using a malicious/compromised authorization server that returns the exploit URL in the authorization_endpoint field so the client opens it automatically; no authentication is required (PR:N).