---
id: CVE-2025-64340
aliases:
  - GHSA-m8x7-r2rg-vh5g
  - PYSEC-2026-2475
title: FastMCP has a Command Injection vulnerability - Gemini CLI
summary: FastMCP has a Command Injection vulnerability - Gemini CLI
severity: medium
cvss: 6.7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H'
vendor: fastmcp
product: fastmcp
ecosystem: pip
affected:
  - fastmcp < 3.2.0
patched:
  - fastmcp 3.2.0
published: '2026-03-31'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:51:00.538174997Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-m8x7-r2rg-vh5g'
references:
  - url: >-
      https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-m8x7-r2rg-vh5g
  - url: 'https://github.com/jlowin/fastmcp/security/advisories/GHSA-m8x7-r2rg-vh5g'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-64340'
  - url: 'https://github.com/PrefectHQ/fastmcp/pull/3522'
  - url: 'https://github.com/PrefectHQ/fastmcp'
tags:
  - osv
  - pip
epss: 0.00735
epssPercentile: 0.53013
ingestedAt: '2026-07-13T18:58:00.477Z'
---

## Overview

Server names containing shell metacharacters (e.g., `&`) can cause command injection on Windows when passed to `fastmcp install claude-code` or `fastmcp install gemini-cli`. These install paths use `subprocess.run()` with a list argument, but on Windows the target CLIs often resolve to `.cmd` wrappers that are executed through `cmd.exe`, which interprets metacharacters in the flattened command string.

PoC:
```python
from fastmcp import FastMCP

mcp = FastMCP(name="test&calc")

@mcp.tool
def roll_dice(n_dice: int) -> list[int]:
    """Roll `n_dice` 6-sided dice and return the results."""
    return [random.randint(1, 6) for _ in range(n_dice)]
```

```
fastmcp install claude-code server.py   # or: fastmcp install gemini-cli server.py
```

On Windows, this opens Calculator via the `&calc` in the server name.

Impact:
Arbitrary command execution with the privileges of the user running `fastmcp install`. Affects Windows hosts where the target CLI (one of claude, gemini) is installed as a `.cmd` wrapper. Does not affect macOS/Linux, and does not affect config-file-based install targets (cursor, goose, mcp-json).

Patched in #3522 by validating server names to reject shell metacharacters.

## Affected packages

- `fastmcp < 3.2.0`

## Remediation

Upgrade to a patched release:

- `fastmcp 3.2.0`