GHSA-m8x7-r2rg-vh5g

Suggest an improvement
Source
https://github.com/advisories/GHSA-m8x7-r2rg-vh5g
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-m8x7-r2rg-vh5g/GHSA-m8x7-r2rg-vh5g.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-m8x7-r2rg-vh5g
Aliases
Downstream
CGA (2)
ECHO (1)
Published
2026-03-31T22:24:15Z
Modified
2026-09-10T03:51:00Z
Severity
  • 6.7 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
FastMCP has a Command Injection vulnerability - Gemini CLI
Details

Server names containing shell metacharacters (e.g., &) can cause command injection on Windows when passed to fastmcp install claude-code or fastmcp install gemini-cli. These install paths use subprocess.run() with a list argument, but on Windows the target CLIs often resolve to .cmd wrappers that are executed through cmd.exe, which interprets metacharacters in the flattened command string.

PoC:

from fastmcp import FastMCP

mcp = FastMCP(name="test&calc")

@mcp.tool
def roll_dice(n_dice: int) -> list[int]:
    """Roll `n_dice` 6-sided dice and return the results."""
    return [random.randint(1, 6) for _ in range(n_dice)]

fastmcp install claude-code server.py   # or: fastmcp install gemini-cli server.py

On Windows, this opens Calculator via the &calc in the server name.

Impact: Arbitrary command execution with the privileges of the user running fastmcp install. Affects Windows hosts where the target CLI (one of claude, gemini) is installed as a .cmd wrapper. Does not affect macOS/Linux, and does not affect config-file-based install targets (cursor, goose, mcp-json).

Patched in #3522 by validating server names to reject shell metacharacters.

Database specific 
{
    "cwe_ids":  [
        "CWE-78"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-31T22:24:15Z",
    "nvd_published_at":  "2026-04-03T16:16:23Z",
    "severity":  "MODERATE"
}
References

Affected packages

PyPI / fastmcp

Package

Name
fastmcp
View open source insights on deps.dev
Purl
pkg:pypi/fastmcp

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.2.0

Affected versions

0.*
0.1.0
0.2.0
0.3.0
0.3.1
0.3.2
0.3.3
0.3.4
0.3.5
0.4.0
0.4.1
1.*
1.0
2.*
2.0.0
2.1.0
2.1.1
2.1.2
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.2.8
2.2.9
2.2.10
2.3.0rc1
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.7.0
2.7.1
2.8.0
2.8.1
2.9.0
2.9.1
2.9.2
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.11.0
2.11.1
2.11.2
2.11.3
2.12.0rc1
2.12.0
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.13.0rc1
2.13.0rc2
2.13.0rc3
2.13.0
2.13.0.1
2.13.0.2
2.13.1
2.13.2
2.13.3
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
3.*
3.0.0b1
3.0.0b2
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0
3.0.1
3.0.2
3.1.0
3.1.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-m8x7-r2rg-vh5g/GHSA-m8x7-r2rg-vh5g.json"