{"action":"Upgrade fastmcp to 2.13.0 or later.","affected":[{"fixed":"2.13.0","introduced":"0"}],"component":"fastmcp","cve_ids":["CVE-2025-62800"],"ecosystem":"PyPI","epss":0.00276,"exploited":false,"fixed_versions":["2.13.0"],"ghsa_id":"GHSA-mxxr-jv3v-6pgc","id":"tcs_01M5KGS57C01B56A1XDQWZK0NW","modified_at":"2026-07-07T17:47:12.914598102Z","published_at":"2026-07-07T16:03:08.608105Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1364","https://github.com/jlowin/fastmcp/security/advisories/GHSA-mxxr-jv3v-6pgc","https://nvd.nist.gov/vuln/detail/CVE-2025-62800","https://github.com/jlowin/fastmcp/pull/2090","https://github.com/jlowin/fastmcp/commit/2a20f54617a37213ed83894a8c2f0ac38a2e83a3","https://github.com/jlowin/fastmcp","https://pypi.org/project/fastmcp","https://github.com/advisories/GHSA-mxxr-jv3v-6pgc"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"PYSEC-2026-1364","url":"https://osv.dev/vulnerability/PYSEC-2026-1364"},{"source":"nvd","source_id":"CVE-2025-62800","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62800"}],"summary":"FastMCP vulnerable to reflected XSS in client's callback page"}