Executive brief
FastlyMCP is a tool that allows AI assistants to interact with the Fastly API using the Model Context Protocol (MCP). A security flaw in the tool's command-line interface component allows a remote attacker to execute unauthorized operating system commands on the host server. This could lead to a total compromise of the server, including the theft of sensitive API keys, data exposure, or service disruption.
Technical details
An OS command injection vulnerability exists in the fastly_cli tool of the FastlyMCP server. The root cause is the improper neutralization of special elements within the 'command' argument in the file fastly-mcp.mjs. Specifically, the application takes attacker-controlled input and interpolates it into a PowerShell command string which is then executed via the child_process.exec function. A remote attacker can use shell metacharacters (such as semicolons) to escape the intended command and execute arbitrary OS commands with the privileges of the MCP server process. As of the advisory date, no patch is available, and the project uses a rolling release model.
Affected products
- jackwrichards FastlyMCP (fastly-mcp-server) up to 6f3d0b0e654fc51076badc7fa16c03c461f95620
Timeline
- 2026-04-10: disclosed: Vulnerability reported to the vendor via GitHub issue
- 2026-04-28: advisory: NVD/VulDB advisory published