PT-2026-35652 · Fastlymcp · Fastlymcp

Cpt_Penner · Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-7220

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FastlyMCP versions up to 6f3d0b0e654fc51076badc7fa16c03c461f95620

Description An OS command injection flaw exists in the fastly cli Tool within the fastly-mcp.mjs file. A remote attacker can exploit this by manipulating the command argument. OS command injection is a vulnerability that allows an attacker to execute arbitrary operating system commands on the server running the application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2026-7220

Affected Products

Fastlymcp

References · 9

• 🔥 https://github.com/jackwrichards/FastlyMCP/issues/3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7220 · Security Note
• https://t.me/CVEtracker/52036 · Telegram Post
• https://github.com/jackwrichards/FastlyMCP · Note
• https://vuldb.com/vuln/359820 · Note
• https://twitter.com/CVEarity/status/2049119081689977226 · Twitter Post
• https://vuldb.com/vuln/359820/cti · Note
• https://vuldb.com/submit/802138 · Note
• https://t.me/cveNotify/161194 · Telegram Post