Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

FastMCP v2.x receives security updates. Earlier versions are no longer supported.

Version	Supported
2.x	✅
< 2.0	❌

Reporting a Vulnerability

Please report security vulnerabilities privately using GitHub's security advisory feature.

Do not open public issues for security concerns.

Reflected XSS in client's callback page
GHSA-mxxr-jv3v-6pgc published Oct 28, 2025 by jlowin

Moderate
FastMCP Auth Integration Allows for Confused Deputy Account Takeover
GHSA-c2jp-c369-7pvx published Oct 28, 2025 by jlowin

High
Windows command injection in FastMCP Cursor installer via server_name
GHSA-rj5c-58rq-j5g5 published Oct 28, 2025 by jlowin

Moderate

Learn more about advisories related to jlowin/fastmcp in the GitHub Advisory Database