{"id":"PYSEC-2026-2475","summary":"FastMCP has a Command Injection vulnerability - Gemini CLI","details":"Server names containing shell metacharacters (e.g., `&`) can cause command injection on Windows when passed to `fastmcp install claude-code` or `fastmcp install gemini-cli`. These install paths use `subprocess.run()` with a list argument, but on Windows the target CLIs often resolve to `.cmd` wrappers that are executed through `cmd.exe`, which interprets metacharacters in the flattened command string.\n\nPoC:\n```python\nfrom fastmcp import FastMCP\n\nmcp = FastMCP(name=\"test&calc\")\n\n@mcp.tool\ndef roll_dice(n_dice: int) -\u003e list[int]:\n    \"\"\"Roll `n_dice` 6-sided dice and return the results.\"\"\"\n    return [random.randint(1, 6) for _ in range(n_dice)]\n```\n\n```\nfastmcp install claude-code server.py   # or: fastmcp install gemini-cli server.py\n```\n\nOn Windows, this opens Calculator via the `&calc` in the server name.\n\nImpact:\nArbitrary command execution with the privileges of the user running `fastmcp install`. Affects Windows hosts where the target CLI (one of claude, gemini) is installed as a `.cmd` wrapper. Does not affect macOS/Linux, and does not affect config-file-based install targets (cursor, goose, mcp-json).\n\nPatched in #3522 by validating server names to reject shell metacharacters.","aliases":["CVE-2025-64340","GHSA-m8x7-r2rg-vh5g"],"modified":"2026-07-13T16:31:55.161769253Z","published":"2026-07-13T14:36:46.084219Z","references":[{"type":"WEB","url":"https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-m8x7-r2rg-vh5g"},{"type":"WEB","url":"https://github.com/jlowin/fastmcp/security/advisories/GHSA-m8x7-r2rg-vh5g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64340"},{"type":"WEB","url":"https://github.com/PrefectHQ/fastmcp/pull/3522"},{"type":"PACKAGE","url":"https://github.com/PrefectHQ/fastmcp"},{"type":"PACKAGE","url":"https://pypi.org/project/fastmcp"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-m8x7-r2rg-vh5g"}],"affected":[{"package":{"name":"fastmcp","ecosystem":"PyPI","purl":"pkg:pypi/fastmcp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0"}]}],"versions":["0.1.0","0.2.0","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.4.0","0.4.1","1.0","2.0.0","2.1.0","2.1.1","2.1.2","2.10.0","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.6","2.11.0","2.11.1","2.11.2","2.11.3","2.12.0","2.12.0rc1","2.12.1","2.12.2","2.12.3","2.12.4","2.12.5","2.13.0","2.13.0.1","2.13.0.2","2.13.0rc1","2.13.0rc2","2.13.0rc3","2.13.1","2.13.2","2.13.3","2.14.0","2.14.1","2.14.2","2.14.3","2.14.4","2.14.5","2.14.6","2.14.7","2.2.0","2.2.1","2.2.10","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9","2.3.0","2.3.0rc1","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.4.0","2.5.0","2.5.1","2.5.2","2.6.0","2.6.1","2.7.0","2.7.1","2.8.0","2.8.1","2.9.0","2.9.1","2.9.2","3.0.0","3.0.0b1","3.0.0b2","3.0.0rc1","3.0.0rc2","3.0.0rc3","3.0.1","3.0.2","3.1.0","3.1.1"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/fastmcp/PYSEC-2026-2475.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"}]}