PT-2026-29413 · Unknown+1 · Gemini-Cli+2

Published 2026-03-31 · Updated 2026-04-14 · CVE-2025-64340

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FastMCP versions prior to 3.2.0

Description FastMCP, a framework for building MCP applications, is susceptible to command injection on Windows systems when server names contain shell metacharacters, such as &. This occurs during the fastmcp install claude-code or fastmcp install gemini-cli processes. The subprocess.run() function, used with a list argument, can be exploited because the target CLIs on Windows often resolve to .cmd wrappers executed by cmd.exe, which interprets these metacharacters. The vulnerability allows for arbitrary command execution with the privileges of the user running the fastmcp install command. Affected systems are Windows hosts with the target CLI installed as a .cmd wrapper. The issue does not affect macOS or Linux, nor does it affect config-file-based install targets.

Recommendations Versions prior to 3.2.0 should be updated to version 3.2.0 or later.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-64340

GHSA-M8X7-R2RG-VH5G

Affected Products

Fastmcp

Claude-Code

Gemini-Cli

References · 8

• 🔥 https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-m8x7-r2rg-vh5g · Exploit
• https://github.com/PrefectHQ/fastmcp/pull/3522 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-64340 · Security Note
• https://osv.dev/vulnerability/GHSA-m8x7-r2rg-vh5g · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2025-64340 · Vendor Advisory
• https://github.com/PrefectHQ/fastmcp · Note
• https://github.com/jlowin/fastmcp/security/advisories/GHSA-m8x7-r2rg-vh5g · Note
• https://twitter.com/CVEnew/status/2040111828584591751 · Twitter Post