Every CVE Search/ Get API key

CVE-2025-64340

FastMCP has a Command Injection vulnerability - Gemini CLI

6.7 MediumFix available

CVE-2025-64340 is a medium vulnerability (CVSS 6.7) in Jlowin Fastmcp, published March 31, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.75%, the 54th percentile. Fixed in fastmcp 3.2.0.

FastMCP is the standard framework for building MCP applications. Prior to version 3.2.0, server names containing shell metacharacters (e.g., &) can cause command injection on Windows when passed to fastmcp install claude-code or fastmcp install gemini-cli. These install paths use subprocess.run() with a list argument, but on Windows the target CLIs often resolve to .cmd wrappers that are executed through cmd.exe, which interprets metacharacters in the flattened command string. This issue has been patched in version 3.2.0.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.75%Up 0.7 points since Apr 4, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.7

FastMCP has a Command Injection vulnerability - Gemini CLI

FastMCP is the standard framework for building MCP applications. Prior to version 3.2.0, server names containing shell metacharacters (e.g., &) can cause command injection on Windows when passed to fastmcp install claude-code or fastmcp install gemini-cli. These install paths use subprocess.run() with a list argument, but on Windows the target CLIs often resolve to .cmd wrappers that are executed through cmd.exe, which interprets metacharacters in the flattened command string. This issue has been patched in version 3.2.0.

Record
CVE-2025-64340
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
EUVDEUVD-2025-209207 6.7

FastMCP is the standard framework for building MCP applications. Prior to version 3.2.0, server names containing shell metacharacters (e.g., &) can cause command injection on Windows when passed to fastmcp install claude-code or fastmcp install gemini-cli. These install paths use subprocess.run() with a list argument, but on Windows the target CLIs often resolve to .cmd wrappers that are executed through cmd.exe, which interprets metacharacters in the flattened command string. This issue has been patched in version 3.2.0.

Record
EUVD-2025-209207
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-m8x7-r2rg-vh5g 6.7

FastMCP has a Command Injection vulnerability - Gemini CLI

Server names containing shell metacharacters (e.g., &) can cause command injection on Windows when passed to fastmcp install claude-code or fastmcp install gemini-cli. These install paths use subprocess.run() with a list argument, but on Windows the target CLIs often resolve to .cmd wrappers that are executed through cmd.exe, which interprets metacharacters in the flattened command string.

PoC:

from fastmcp import FastMCP

mcp = FastMCP(name="test&calc")

@mcp.tool
def roll_dice(n_dice: int) -> list[int]:
    """Roll `n_dice` 6-sided dice and return the results."""
    return [random.randint(1, 6) for _ in range(n_dice)]

fastmcp install claude-code server.py   # or: fastmcp install gemini-cli server.py

On Windows, this opens Calculator via the &calc in the server name.

Impact: Arbitrary command execution with the privileges of the user running fastmcp install. Affects Windows hosts where the target CLI (one of claude, gemini) is installed as a .cmd wrapper. Does not affect macOS/Linux, and does not affect config-file-based install targets (cursor, goose, mcp-json).

Patched in #3522 by validating server names to reject shell metacharacters.

Record
GHSA-m8x7-r2rg-vh5g
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
NVD 6.7

FastMCP is the standard framework for building MCP applications. Prior to version 3.2.0, server names containing shell metacharacters (e.g., &) can cause command injection on Windows when passed to fastmcp install claude-code or fastmcp install gemini-cli. These install paths use subprocess.run() with a list argument, but on Windows the target CLIs often resolve to .cmd wrappers that are executed through cmd.exe, which interprets metacharacters in the flattened command string. This issue has been patched in version 3.2.0.

Record
CVE-2025-64340
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
OSV 6.7

FastMCP has a Command Injection vulnerability - Gemini CLI

FastMCP is the standard framework for building MCP applications. Prior to version 3.2.0, server names containing shell metacharacters (e.g., &) can cause command injection on Windows when passed to fastmcp install claude-code or fastmcp install gemini-cli. These install paths use subprocess.run() with a list argument, but on Windows the target CLIs often resolve to .cmd wrappers that are executed through cmd.exe, which interprets metacharacters in the flattened command string. This issue has been patched in version 3.2.0.

Record
CVE-2025-64340
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
OSVGHSA-m8x7-r2rg-vh5g 6.7

FastMCP has a Command Injection vulnerability - Gemini CLI

Server names containing shell metacharacters (e.g., &) can cause command injection on Windows when passed to fastmcp install claude-code or fastmcp install gemini-cli. These install paths use subprocess.run() with a list argument, but on Windows the target CLIs often resolve to .cmd wrappers that are executed through cmd.exe, which interprets metacharacters in the flattened command string.

PoC:

from fastmcp import FastMCP

mcp = FastMCP(name="test&calc")

@mcp.tool
def roll_dice(n_dice: int) -> list[int]:
    """Roll `n_dice` 6-sided dice and return the results."""
    return [random.randint(1, 6) for _ in range(n_dice)]

fastmcp install claude-code server.py   # or: fastmcp install gemini-cli server.py

On Windows, this opens Calculator via the &calc in the server name.

Impact: Arbitrary command execution with the privileges of the user running fastmcp install. Affects Windows hosts where the target CLI (one of claude, gemini) is installed as a .cmd wrapper. Does not affect macOS/Linux, and does not affect config-file-based install targets (cursor, goose, mcp-json).

Patched in #3522 by validating server names to reject shell metacharacters.

Record
GHSA-m8x7-r2rg-vh5g
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
Show 4 moreShow less
OSVPYSEC-2026-2475 6.7

FastMCP has a Command Injection vulnerability - Gemini CLI

Server names containing shell metacharacters (e.g., &) can cause command injection on Windows when passed to fastmcp install claude-code or fastmcp install gemini-cli. These install paths use subprocess.run() with a list argument, but on Windows the target CLIs often resolve to .cmd wrappers that are executed through cmd.exe, which interprets metacharacters in the flattened command string.

PoC:

from fastmcp import FastMCP

mcp = FastMCP(name="test&calc")

@mcp.tool
def roll_dice(n_dice: int) -> list[int]:
    """Roll `n_dice` 6-sided dice and return the results."""
    return [random.randint(1, 6) for _ in range(n_dice)]

fastmcp install claude-code server.py   # or: fastmcp install gemini-cli server.py

On Windows, this opens Calculator via the &calc in the server name.

Impact: Arbitrary command execution with the privileges of the user running fastmcp install. Affects Windows hosts where the target CLI (one of claude, gemini) is installed as a .cmd wrapper. Does not affect macOS/Linux, and does not affect config-file-based install targets (cursor, goose, mcp-json).

Patched in #3522 by validating server names to reject shell metacharacters.

Record
PYSEC-2026-2475
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVROOT-APP-PYPI-CVE-2025-64340 6.7

CVE-2025-64340 in rootio-fastmcp - Patched by Root

Root has patched CVE-2025-64340 in the rootio-fastmcp package for Root:PyPI. Multiple fixed versions available.

Record
ROOT-APP-PYPI-CVE-2025-64340
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVCLSA-2026-1781139162 No score

TuxCare security update for fastmcp (1 CVE)

TuxCare rebuilt fastmcp to address 1 CVE. Fixed in 2.14.7.post2+tuxcare.

Record
CLSA-2026-1781139162
Updated
2026-11-02
OSVCLSA-2026-1789551772 No score

TuxCare security update for fastmcp (2 CVEs)

TuxCare rebuilt fastmcp to address 2 CVEs. Fixed in 2.14.5.post3+tuxcare.

Record
CLSA-2026-1789551772
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
fastmcp
PyPI
 before 3.2.0
3.2.0
fastmcp
TuxCare:PyPI
 2.14.7 up to 2.14.7.post2+tuxcare, plus listed versions
2.14.7.post1+tuxcare
2.14.7.post2+tuxcare
fastmcp
TuxCare:PyPI
 2.14.5 up to 2.14.5.post3+tuxcare, plus listed versions
2.14.5.post1+tuxcare2.14.5.post2+tuxcare
2.14.5.post3+tuxcare
fastmcp
PyPI
 before 3.2.0, plus listed versions
0.1.00.2.00.3.00.3.10.3.2
Show 45 moreShow less
0.3.30.3.40.3.50.4.00.4.11.02.0.02.1.02.1.12.1.22.10.02.10.12.10.22.10.32.10.42.10.52.10.62.11.02.11.12.11.22.11.32.12.02.12.0rc12.12.12.12.22.12.32.12.42.12.52.13.02.13.0.12.13.0.22.13.0rc12.13.0rc22.13.0rc32.13.12.13.22.13.32.14.02.14.12.14.22.14.32.14.42.14.52.14.62.14.7
3.2.0
rootio-fastmcp
Root:PyPI
 before 2.12.4+root.io.3
2.12.4+root.io.32.12.4+root.io.42.12.4+root.io.5
fastmcp
Root:PyPI
 before 2.12.4+aikido.5
2.12.4+aikido.5

History

History
WhenChangedSources
2026-11-02createdCVE List, EUVD, GitHub Advisories, NVD, OSV

References

This page doesn't list everything

Left out here: 41 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open