PYSEC-2026-2475

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/fastmcp/PYSEC-2026-2475.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2026-2475

Aliases

Published

2026-07-13T14:36:46Z

Modified

2026-07-13T16:31:55Z

Severity

6.7 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

FastMCP has a Command Injection vulnerability - Gemini CLI

Details

Server names containing shell metacharacters (e.g., &) can cause command injection on Windows when passed to fastmcp install claude-code or fastmcp install gemini-cli. These install paths use subprocess.run() with a list argument, but on Windows the target CLIs often resolve to .cmd wrappers that are executed through cmd.exe, which interprets metacharacters in the flattened command string.

PoC:

from fastmcp import FastMCP

mcp = FastMCP(name="test&calc")

@mcp.tool
def roll_dice(n_dice: int) -> list[int]:
    """Roll `n_dice` 6-sided dice and return the results."""
    return [random.randint(1, 6) for _ in range(n_dice)]

fastmcp install claude-code server.py   # or: fastmcp install gemini-cli server.py

On Windows, this opens Calculator via the &calc in the server name.

Impact: Arbitrary command execution with the privileges of the user running fastmcp install. Affects Windows hosts where the target CLI (one of claude, gemini) is installed as a .cmd wrapper. Does not affect macOS/Linux, and does not affect config-file-based install targets (cursor, goose, mcp-json).

Patched in #3522 by validating server names to reject shell metacharacters.

References

Affected packages

PyPI / fastmcp

Package

Name: fastmcp; View open source insights on deps.dev
Purl: pkg:pypi/fastmcp

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.2.0

Affected versions

0.*

0.1.0

0.2.0

0.3.0

0.3.1

0.3.2

0.3.3

0.3.4

0.3.5

0.4.0

0.4.1

1.*

1.0

2.*

2.0.0

2.1.0

2.1.1

2.1.2

2.2.0

2.2.1

2.2.2

2.2.3

2.2.4

2.2.5

2.2.6

2.2.7

2.2.8

2.2.9

2.2.10

2.3.0rc1

2.3.0

2.3.1

2.3.2

2.3.3

2.3.4

2.3.5

2.4.0

2.5.0

2.5.1

2.5.2

2.6.0

2.6.1

2.7.0

2.7.1

2.8.0

2.8.1

2.9.0

2.9.1

2.9.2

2.10.0

2.10.1

2.10.2

2.10.3

2.10.4

2.10.5

2.10.6

2.11.0

2.11.1

2.11.2

2.11.3

2.12.0rc1

2.12.0

2.12.1

2.12.2

2.12.3

2.12.4

2.12.5

2.13.0rc1

2.13.0rc2

2.13.0rc3

2.13.0

2.13.0.1

2.13.0.2

2.13.1

2.13.2

2.13.3

2.14.0

2.14.1

2.14.2

2.14.3

2.14.4

2.14.5

2.14.6

2.14.7

3.*

3.0.0b1

3.0.0b2

3.0.0rc1

3.0.0rc2

3.0.0rc3

3.0.0

3.0.1

3.0.2

3.1.0

3.1.1

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/fastmcp/PYSEC-2026-2475.yaml"