---
schema_version: '1.0'
id: security-20260714-ea9700
url: https://osv.dev/vulnerability/PYSEC-2026-2475
url_hash: ea9700f2a9be5a163b101ff12aa3ad29999c26a11bf46670e6d18e3148d17818
canonical_url: https://osv.dev/vulnerability/PYSEC-2026-2475
source: osv:pypa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2025-64340
- PYSEC-2026-2475
- severity:CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- fastmcp
- PyPI
lang: en
published_at: '2026-07-13T14:36:46Z'
fetched_at: '2026-07-14T06:42:23Z'
updated_at: '2026-07-14T06:43:41Z'
status: published
content_hash: 863006db8e30c252ca226a7e6e166c9c4ef7e4f7e97f153187ccf64b21d79a96
license_note: full
summary: FastMCP has a Command Injection vulnerability - Gemini CLI
summary_source: rss
summary_en: FastMCP has a Command Injection vulnerability - Gemini CLI
entities:
- name: HashMark
  type: other
- name: Command Approval Required
  type: concept
key_facts: []
related: []
related_auto:
- name: 井案
  type: UNKNOWN
  weight: 1.0
- name: Hermes
  type: artifact
  weight: 1.0
title: 'CVE-2025-64340: FastMCP has a Command Injection vulnerability - Gemini CLI'
---

# CVE-2025-64340: FastMCP has a Command Injection vulnerability - Gemini CLI

## TL;DR
FastMCP has a Command Injection vulnerability - Gemini CLI

## Key Points
- cve / CVE-2025-64340 / PYSEC-2026-2475 / severity:CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H / fastmcp / PyPI

## Details
**Severity:** CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
**Advisory:** PYSEC-2026-2475 (CVE-2025-64340)

**Affected (your watchlist):**
- `PyPI:fastmcp` 2.11.3 → fixed in 3.2.0 [docker/docker-portal+portal]

**Details:**
Server names containing shell metacharacters (e.g., `&`) can cause command injection on Windows when passed to `fastmcp install claude-code` or `fastmcp install gemini-cli`. These install paths use `subprocess.run()` with a list argument, but on Windows the target CLIs often resolve to `.cmd` wrappers that are executed through `cmd.exe`, which interprets metacharacters in the flattened command string.

PoC:
```python
from fastmcp import FastMCP

mcp = FastMCP(name="test&calc")

@mcp.tool
def roll_dice(n_dice: int) -> list[int]:
    """Roll `n_dice` 6-sided dice and return the results."""
    return [random.randint(1, 6) for _ in range(n_dice)]
```

```
fastmcp install claude-code server.py   # or: fastmcp install gemini-cli server.py
```

On Windows, this opens Calculator via the `&calc` in the server name.

Impact:
Arbitrary command execution with the privileges of the user running `fastmcp install`. Affects Windows hosts where the target CLI (one of claude, gemini) is installed as a `.cmd` wrapper. Does not affect macOS/Linux, and does not affect config-file-based install targets (cursor, goose, mcp-json).

Patched in #3522 by validating server names to reject shell metacharacters.

**References:**
- https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-m8x7-r2rg-vh5g
- https://github.com/jlowin/fastmcp/security/advisories/GHSA-m8x7-r2rg-vh5g
- https://nvd.nist.gov/vuln/detail/CVE-2025-64340
- https://github.com/PrefectHQ/fastmcp/pull/3522
- https://github.com/PrefectHQ/fastmcp
- https://pypi.org/project/fastmcp
- https://github.com/advisories/GHSA-m8x7-r2rg-vh5g

_Data: OSV.dev (upstream: pypa) — https://osv.dev/vulnerability/PYSEC-2026-2475_

## Source
元記事: [CVE-2025-64340: FastMCP has a Command Injection vulnerability - Gemini CLI](https://osv.dev/vulnerability/PYSEC-2026-2475) — published 2026-07-13T14:36:46Z