FastMCP's maintainers published a critical advisory (GHSA-gpgx-58w2-xwwf) on Oct 16. When a FastMCP client parses a successful structured tool result, the self-reference ($ref: "#") branch of its JSON-schema converter passes the server-supplied schema title straight to a Python ForwardRef, which Pydantic then evaluates. A server that returns a crafted outputSchema can therefore run code with the client process's privileges. The surrounding exception handler only logs, so the tool call still returns normally and nothing signals that code ran. The advisory includes a working PoC over both in-memory and HTTP transports. It also flags server-controlled form elicitation schemas as a second path that goes through the same converter.

Affected: fastmcp >= 2.10.0 and < 3.4.8, and 4.0.0a1 to < 4.0.11. Fixed: 3.4.8 and 4.0.11. No 2.x fix is listed, so 2.x users must move to 3.4.8 or later. No CVE is listed on the advisory.

Why it matters: this flips the usual MCP threat model. Here the server attacks the client through ordinary protocol metadata, with no prompt injection needed. Any agent, IDE plugin or backend that uses the FastMCP client to talk to third-party or user-supplied MCP servers is exposed. Do now: run pip show fastmcp (and check lockfiles and container images) and upgrade. Until you have, connect only to MCP servers you control, and run MCP clients in a sandbox without access to your home directory, cloud credentials or SSH keys.