{"id":"CVE-2025-64340","aliases":["GHSA-m8x7-r2rg-vh5g","PYSEC-2026-2475"],"url":"https://o3.security/vulnerability/CVE-2025-64340","summary":"FastMCP has a Command Injection vulnerability - Gemini CLI","details":"Server names containing shell metacharacters (e.g., `&`) can cause command injection on Windows when passed to `fastmcp install claude-code` or `fastmcp install gemini-cli`. These install paths use `subprocess.run()` with a list argument, but on Windows the target CLIs often resolve to `.cmd` wrappers that are executed through `cmd.exe`, which interprets metacharacters in the flattened command string.\n\nPoC:\n```python\nfrom fastmcp import FastMCP\n\nmcp = FastMCP(name=\"test&calc\")\n\n@mcp.tool\ndef roll_dice(n_dice: int) -> list[int]:\n    \"\"\"Roll `n_dice` 6-sided dice and return the results.\"\"\"\n    return [random.randint(1, 6) for _ in range(n_dice)]\n```\n\n```\nfastmcp install claude-code server.py   # or: fastmcp install gemini-cli server.py\n```\n\nOn Windows, this opens Calculator via the `&calc` in the server name.\n\nImpact:\nArbitrary command execution with the privileges of the user running `fastmcp install`. Affects Windows hosts where the target CLI (one of claude, gemini) is installed as a `.cmd` wrapper. Does not affect macOS/Linux, and does not affect config-file-based install targets (cursor, goose, mcp-json).\n\nPatched in #3522 by validating server names to reject shell metacharacters.","published":"2026-04-03T15:16:13.930Z","modified":"2026-08-27T03:30:27.921125575Z","cvss":{"score":6.7,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"fastmcp","fixedVersion":"3.2.0"}],"fix":{"url":"https://github.com/PrefectHQ/fastmcp/pull/3522","label":"PrefectHQ/fastmcp#3522"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64340.json"},{"type":"ADVISORY","url":"https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-m8x7-r2rg-vh5g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64340"},{"type":"FIX","url":"https://github.com/PrefectHQ/fastmcp/pull/3522"},{"type":"WEB","url":"https://github.com/jlowin/fastmcp/security/advisories/GHSA-m8x7-r2rg-vh5g"},{"type":"PACKAGE","url":"https://github.com/PrefectHQ/fastmcp"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-27T03:30:27.921125575Z"}}