Cloudanix VulnDB

CVE-2025-64340

Medium · 6.7

CVSS

6.7

EPSS

0.7%

Published

Apr 3, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A setup tool in a popular software framework can let attackers run their own commands on Windows machines if certain names are used during installation.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
High
Impact
Full Compromise
Component
Library
Class
Command Injection
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Command injection on Windows when server names containing shell metacharacters are passed to fastmcp install claude-code or fastmcp install gemini-cli, because subprocess.run lists are flattened through cmd.exe wrappers that interpret the metacharacters.

Why it matters to the business

Attackers can execute arbitrary commands on developer or build systems, enabling unauthorized code execution, data access, or persistence that disrupts operations and requires incident response.

How an attack unfolds

An attacker crafts a server name containing metacharacters such as '&' and supplies it to one of the affected fastmcp install commands; on Windows the .cmd wrapper causes cmd.exe to interpret the name as part of the command line, resulting in injected commands being executed.

How to fix it

Upgrade FastMCP to version 3.2.0 or later on all affected systems; avoid using the install commands with untrusted server names until the upgrade is complete.

How to confirm the fix worked

Confirm the installed FastMCP package version is 3.2.0 or higher; attempt reproduction with a test server name containing '&' and verify that no extraneous commands execute.

Typical attack path

  1. Locate a Windows system using FastMCP prior to 3.2.0
  2. Create a malicious server name containing shell metacharacters
  3. Invoke fastmcp install claude-code or fastmcp install gemini-cli with the crafted name
  4. Trigger command execution through the cmd.exe wrapper path

How to detect it

Search process creation and command-line logs for fastmcp install invocations that contain metacharacters in server name arguments; correlate with unexpected child processes launched by cmd.exe during those operations.

What your security team should do

  • Prioritize upgrade of all FastMCP installations to 3.2.0 within the next maintenance window
  • Audit scripts and CI pipelines that invoke fastmcp install commands
  • Add allow-listing or sanitization for server names supplied to install functions
  • Review Windows event logs and process creation telemetry for suspicious cmd.exe invocations originating from fastmcp

The record

FastMCP is the standard framework for building MCP applications. Prior to version 3.2.0, server names containing shell metacharacters (e.g., &) can cause command injection on Windows when passed to fastmcp install claude-code or fastmcp install gemini-cli. These install paths use subprocess.run() with a list argument, but on Windows the target CLIs often resolve to .cmd wrappers that are executed through cmd.exe, which interprets metacharacters in the flattened command string. This issue has been patched in version 3.2.0.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities