# CVE-2025-64340: PrefectHQ FastMCP command injection in CLI install on Windows

Source: https://junglewise.ai/threats/cve-2025-64340-prefecthq-fastmcp-command-injection-in-cli-install-on-windows  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-03. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2025-64340 · Severity: medium · CVSS 6.7 · Published 2026-04-03

FastMCP is a framework used to build applications for the Model Context Protocol (MCP). A security flaw in its installation process on Windows allows an attacker to execute unauthorized commands on a user's computer. This occurs when a specially crafted server name containing symbols like '&' is used during the installation of certain AI tools, potentially leading to a full system compromise or data theft.

Technologies: [fastmcp (PyPI)](https://junglewise.ai/threats/technologies/fastmcp). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2025-64340 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-64340 being exploited in the wild.

**How severe is CVE-2025-64340?** Medium severity, with a CVSS score of 6.7, published 3 April 2026.

**Which products and versions are affected?** fastmcp (PyPI) ECOSYSTEM:introduced=0,fixed=3.2.0.

**Is there a fix for CVE-2025-64340?** Yes. fastmcp (PyPI): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-64340 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2025-64340?** Check whether you run fastmcp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- fastmcp (PyPI): upgrade to 3.2.0 or later

  ```sh
  pip install "fastmcp>=3.2.0"
  ```


## Technical details

An OS command injection vulnerability exists in FastMCP's CLI installation paths for 'claude-code' and 'gemini-cli' on Windows. While the framework uses subprocess.run() with a list argument, Windows often resolves the target CLIs to .cmd wrappers. These wrappers are executed via cmd.exe, which flattens the argument list into a string and interprets shell metacharacters (e.g., '&'). An attacker can exploit this by providing a malicious server name containing these characters. The vulnerability requires local access and user interaction (running the install command) and is specific to Windows environments where the target CLI is a .cmd wrapper. The issue was addressed in version 3.2.0 by implementing strict alphanumeric validation for server names.

## Affected products

- PrefectHQ (jlowin) FastMCP < 3.2.0

## Identifiers

- CVE-2025-64340
- GHSA-m8x7-r2rg-vh5g
- PYSEC-2026-2475

## Timeline

- 2026-03-15: patched: Pull request #3522 merged to validate server names.
- 2026-03-31: advisory: GitHub Security Advisory GHSA-m8x7-r2rg-vh5g published.
- 2026-04-03: disclosed: CVE-2025-64340 published to NVD.

## References

- [https://github.com/PrefectHQ/fastmcp/pull/3522](https://github.com/PrefectHQ/fastmcp/pull/3522)
- [https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-m8x7-r2rg-vh5g](https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-m8x7-r2rg-vh5g)

## Related threats

- [FastMCP post-transform component authorization bypass](https://junglewise.ai/threats/fastmcp-post-transform-component-authorization-is-skipped-on-direct-a9992939)
- [FastMCP OAuth provider missing issuer binding in M2M credential exchange](https://junglewise.ai/threats/fastmcp-mcp-client-wrappers-construct-m2m-oauth-providers-without-af21ca1f)
- [FastMCP confused deputy vulnerability in OAuthProxy callback](https://junglewise.ai/threats/cve-2026-27124-fastmcp-confused-deputy-vulnerability-in-oauthproxy-callback)
- [PrefectHQ FastMCP path traversal and SSRF in OpenAPIProvider](https://junglewise.ai/threats/cve-2026-32871-prefecthq-fastmcp-path-traversal-and-ssrf-in-openapiprovider)
- [PrefectHQ FastMCP improper resource handling in OAuth Proxy](https://junglewise.ai/threats/cve-2025-69196-prefecthq-fastmcp-improper-resource-handling-in-oauth-proxy)