CVE-2025-64340

FastMCP is the standard framework for building MCP applications. Prior to version 3.2.0, server names containing shell metacharacters (e.g., &) can cause command injection on Windows when passed to fastmcp install claude-code or fastmcp install gemini-cli. These install paths use subprocess.run() with a list argument, but on Windows the target CLIs often resolve to .cmd wrappers that are executed through cmd.exe, which interprets metacharacters in the flattened command string. This issue has been patched in version 3.2.0.

• CWE-78

• https://github.com/PrefectHQ/fastmcp/pull/3522Issue Tracking, Patch
• https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-m8x7-r2rg-vh5gExploit, Patch, Vendor Advisory
• https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-m8x7-r2rg-vh5gExploit, Patch, Vendor Advisory

Published

Apr 3, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-64334Suricata is a network IDS, IPS and NSM engine developed by t…7.5
• CVE-2025-64335Suricata is a network IDS, IPS and NSM engine developed by t…7.5
• CVE-2025-64336ClipBucket v5 is an open source video sharing platform. In v…5.4
• CVE-2025-64338ClipBucket v5 is an open source video sharing platform. In v…9
• CVE-2025-64339ClipBucket v5 is an open source video sharing platform. In v…5.4
• CVE-2025-6434The exception page for the HTTPS-Only feature, displayed whe…4.3
• CVE-2025-64342ESF-IDF is the Espressif Internet of Things (IOT) Developmen…6.9
• CVE-2025-64343(conda) Constructor is a tool that enables users to create i…7.8
• CVE-2025-64344Suricata is a network IDS, IPS and NSM engine developed by t…7.5
• CVE-2025-64345Wasmtime is a runtime for WebAssembly. Prior to version 38.0…1.8
• CVE-2025-64346archives is a Go library for extracting archives (tar, zip, …6
• CVE-2025-64347Apollo Router Core is a configurable Rust graph router writt…7.5