-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a classic reflected Cross-Site Scripting (XSS) issue within the FastMCP client's OAuth callback mechanism. The root cause is the failure to escape user-controlled input before embedding it into the generated HTML page. The analysis of the security patch 2a20f54617a37213ed83894a8c2f0ac38a2e83a3 confirms this. The primary function, create_callback_html, receives parameters from the HTTP request (e.g., the error query parameter) and uses several helper functions from fastmcp.utilities.ui to construct the response. The patch shows that these helper functions (create_info_box, create_page, create_status_message, create_detail_box) were modified to add html.escape() to their inputs. This indicates that they were previously rendering raw HTML, allowing an attacker to inject malicious scripts. Therefore, during exploitation, a profiler would show create_callback_html as the function processing the malicious input and calling the other identified vulnerable functions to render the final payload.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| fastmcp | pip | < 2.13.0 | 2.13.0 |
A Semantic Attack on Google Gemini - Read the Latest Research