Is CVE-2025-64340 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-64340 being exploited in the wild.

How severe is CVE-2025-64340?

Medium severity, with a CVSS score of 6.7, published 3 April 2026.

Which products and versions are affected?

fastmcp (PyPI) ECOSYSTEM:introduced=0,fixed=3.2.0.

Is there a fix for CVE-2025-64340?

Yes. fastmcp (PyPI): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-64340 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2025-64340?

Check whether you run fastmcp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-64340: PrefectHQ FastMCP command injection in CLI install on Windows

CVE-2025-64340 · Severity: medium · CVSS 6.7 · Published 2026-04-03

FastMCP is a framework used to build applications for the Model Context Protocol (MCP). A security flaw in its installation process on Windows allows an attacker to execute unauthorized commands on a user's computer. This occurs when a specially crafted server name containing symbols like '&' is used during the installation of certain AI tools, potentially leading to a full system compromise or data theft.

Technologies: fastmcp (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-64340 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-64340 being exploited in the wild.
How severe is CVE-2025-64340?: Medium severity, with a CVSS score of 6.7, published 3 April 2026.
Which products and versions are affected?: fastmcp (PyPI) ECOSYSTEM:introduced=0,fixed=3.2.0.
Is there a fix for CVE-2025-64340?: Yes. fastmcp (PyPI): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-64340 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2025-64340?: Check whether you run fastmcp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

fastmcp (PyPI): upgrade to 3.2.0 or later
```
pip install "fastmcp>=3.2.0"
```

Technical details

An OS command injection vulnerability exists in FastMCP's CLI installation paths for 'claude-code' and 'gemini-cli' on Windows. While the framework uses subprocess.run() with a list argument, Windows often resolves the target CLIs to .cmd wrappers. These wrappers are executed via cmd.exe, which flattens the argument list into a string and interprets shell metacharacters (e.g., '&'). An attacker can exploit this by providing a malicious server name containing these characters. The vulnerability requires local access and user interaction (running the install command) and is specific to Windows environments where the target CLI is a .cmd wrapper. The issue was addressed in version 3.2.0 by implementing strict alphanumeric validation for server names.

Affected products

PrefectHQ (jlowin) FastMCP < 3.2.0

Identifiers

CVE-2025-64340
GHSA-m8x7-r2rg-vh5g
PYSEC-2026-2475

Timeline

2026-03-15: patched: Pull request #3522 merged to validate server names.
2026-03-31: advisory: GitHub Security Advisory GHSA-m8x7-r2rg-vh5g published.
2026-04-03: disclosed: CVE-2025-64340 published to NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.