Executive brief
FastMCP is a framework used to build applications for the Model Context Protocol (MCP). A security flaw in its installation process on Windows allows an attacker to execute unauthorized commands on a user's computer. This occurs when a specially crafted server name containing symbols like '&' is used during the installation of certain AI tools, potentially leading to a full system compromise or data theft.
Technical details
An OS command injection vulnerability exists in FastMCP's CLI installation paths for 'claude-code' and 'gemini-cli' on Windows. While the framework uses subprocess.run() with a list argument, Windows often resolves the target CLIs to .cmd wrappers. These wrappers are executed via cmd.exe, which flattens the argument list into a string and interprets shell metacharacters (e.g., '&'). An attacker can exploit this by providing a malicious server name containing these characters. The vulnerability requires local access and user interaction (running the install command) and is specific to Windows environments where the target CLI is a .cmd wrapper. The issue was addressed in version 3.2.0 by implementing strict alphanumeric validation for server names.
Affected products
- PrefectHQ (jlowin) FastMCP < 3.2.0
Timeline
- 2026-03-15: patched: Pull request #3522 merged to validate server names.
- 2026-03-31: advisory: GitHub Security Advisory GHSA-m8x7-r2rg-vh5g published.
- 2026-04-03: disclosed: CVE-2025-64340 published to NVD.