{"id":"CVE-2025-64340","aliases":["GHSA-m8x7-r2rg-vh5g","PYSEC-2026-2475"],"title":"FastMCP has a Command Injection vulnerability - Gemini CLI","summary":"FastMCP has a Command Injection vulnerability - Gemini CLI","severity":"medium","cvss":6.7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","vendor":"fastmcp","product":"fastmcp","ecosystem":"pip","affected":["fastmcp < 3.2.0"],"patched":["fastmcp 3.2.0"],"published":"2026-03-31","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:51:00.538174997Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-m8x7-r2rg-vh5g","references":[{"url":"https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-m8x7-r2rg-vh5g"},{"url":"https://github.com/jlowin/fastmcp/security/advisories/GHSA-m8x7-r2rg-vh5g"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64340"},{"url":"https://github.com/PrefectHQ/fastmcp/pull/3522"},{"url":"https://github.com/PrefectHQ/fastmcp"}],"tags":["osv","pip"],"epss":0.00735,"epssPercentile":0.5253,"ingestedAt":"2026-07-13T18:58:00.477Z","slug":"CVE-2025-64340","body":"## Overview\n\nServer names containing shell metacharacters (e.g., `&`) can cause command injection on Windows when passed to `fastmcp install claude-code` or `fastmcp install gemini-cli`. These install paths use `subprocess.run()` with a list argument, but on Windows the target CLIs often resolve to `.cmd` wrappers that are executed through `cmd.exe`, which interprets metacharacters in the flattened command string.\n\nPoC:\n```python\nfrom fastmcp import FastMCP\n\nmcp = FastMCP(name=\"test&calc\")\n\n@mcp.tool\ndef roll_dice(n_dice: int) -> list[int]:\n    \"\"\"Roll `n_dice` 6-sided dice and return the results.\"\"\"\n    return [random.randint(1, 6) for _ in range(n_dice)]\n```\n\n```\nfastmcp install claude-code server.py   # or: fastmcp install gemini-cli server.py\n```\n\nOn Windows, this opens Calculator via the `&calc` in the server name.\n\nImpact:\nArbitrary command execution with the privileges of the user running `fastmcp install`. Affects Windows hosts where the target CLI (one of claude, gemini) is installed as a `.cmd` wrapper. Does not affect macOS/Linux, and does not affect config-file-based install targets (cursor, goose, mcp-json).\n\nPatched in #3522 by validating server names to reject shell metacharacters.\n\n## Affected packages\n\n- `fastmcp < 3.2.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `fastmcp 3.2.0`","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":36.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}