---
schema_version: '1.0'
id: security-20260705-a2eedf
url: https://osv.dev/vulnerability/GHSA-m8x7-r2rg-vh5g
url_hash: a2eedf09d71d6e15d9ae57907a3f0d482e4d0d8ade5ca7bebdb87da08cde733e
canonical_url: https://osv.dev/vulnerability/GHSA-m8x7-r2rg-vh5g
source: osv:ghsa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2025-64340
- GHSA-m8x7-r2rg-vh5g
- severity:CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- fastmcp
- PyPI
lang: en
published_at: '2026-03-31T22:24:15Z'
fetched_at: '2026-07-05T15:34:34Z'
updated_at: '2026-07-11T06:37:45Z'
status: published
content_hash: 8d02473b820e194290c8174ececae68a785f8b964c7ac7fa97f404eb78b52e02
license_note: full
summary: FastMCP has a Command Injection vulnerability - Gemini CLI
summary_source: rss
summary_en: FastMCP has a Command Injection vulnerability - Gemini CLI
entities:
- name: HashTag
  type: concept
- name: Command and Conquer Generals
  type: artifact
related_auto:
- name: SustainableQuantumComputing
  type: concept
  weight: 3.0
title: 'CVE-2025-64340: FastMCP has a Command Injection vulnerability - Gemini CLI'
---

# CVE-2025-64340: FastMCP has a Command Injection vulnerability - Gemini CLI

## TL;DR
FastMCP has a Command Injection vulnerability - Gemini CLI

## Key Points
- cve / CVE-2025-64340 / GHSA-m8x7-r2rg-vh5g / severity:CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H / fastmcp / PyPI

## Details
**Severity:** CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
**Advisory:** GHSA-m8x7-r2rg-vh5g (CVE-2025-64340)

**Affected (your watchlist):**
- `PyPI:fastmcp` 2.11.3 → fixed in 3.2.0 [docker/docker-portal+portal]

**Details:**
Server names containing shell metacharacters (e.g., `&`) can cause command injection on Windows when passed to `fastmcp install claude-code` or `fastmcp install gemini-cli`. These install paths use `subprocess.run()` with a list argument, but on Windows the target CLIs often resolve to `.cmd` wrappers that are executed through `cmd.exe`, which interprets metacharacters in the flattened command string.

PoC:
```python
from fastmcp import FastMCP

mcp = FastMCP(name="test&calc")

@mcp.tool
def roll_dice(n_dice: int) -> list[int]:
    """Roll `n_dice` 6-sided dice and return the results."""
    return [random.randint(1, 6) for _ in range(n_dice)]
```

```
fastmcp install claude-code server.py   # or: fastmcp install gemini-cli server.py
```

On Windows, this opens Calculator via the `&calc` in the server name.

Impact:
Arbitrary command execution with the privileges of the user running `fastmcp install`. Affects Windows hosts where the target CLI (one of claude, gemini) is installed as a `.cmd` wrapper. Does not affect macOS/Linux, and does not affect config-file-based install targets (cursor, goose, mcp-json).

Patched in #3522 by validating server names to reject shell metacharacters.

**References:**
- https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-m8x7-r2rg-vh5g
- https://github.com/jlowin/fastmcp/security/advisories/GHSA-m8x7-r2rg-vh5g
- https://nvd.nist.gov/vuln/detail/CVE-2025-64340
- https://github.com/PrefectHQ/fastmcp/pull/3522
- https://github.com/PrefectHQ/fastmcp

_Data: OSV.dev (upstream: ghsa) — https://osv.dev/vulnerability/GHSA-m8x7-r2rg-vh5g_

## Source
元記事: [CVE-2025-64340: FastMCP has a Command Injection vulnerability - Gemini CLI](https://osv.dev/vulnerability/GHSA-m8x7-r2rg-vh5g) — published 2026-03-31T22:24:15Z