FastMCP Windows cmd.exe Injection via Server Name Metacharacters (CVE-2025-64340)
FastMCP versions before 3.2.0 take the name of an MCP server and pass it, unchecked, into Windows cmd.exe when you run the install command for Claude Code or Gemini CLI. If that name contains shell characters like & or |, Windows runs them as commands instead of treating them as plain text.
How the attack works
An attacker crafts an MCP server definition where the 'name' field contains characters such as & | > ^ ( ), for example naming a server 'test&calc'. A victim (or automated pipeline) runs 'fastmcp install claude-code' or 'fastmcp install gemini-cli' against this server. Those installers resolve to .cmd wrapper scripts on Windows, and cmd.exe interprets the entire flattened argument string rather than treating the name as inert data. The embedded metacharacters execute as a second command alongside the intended install action, giving the attacker arbitrary command execution in the context of whoever ran the install.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 8758d153-4639-4f14-806c-e117ee26ca18
- Severity
- High
- CVEs
- CVE-2025-64340
Why it matters
An attacker who controls or influences an MCP server's name field can achieve arbitrary command execution on a Windows machine simply by getting someone to run a normal-looking FastMCP install command, with no separate exploit delivery needed.
What you can do
- →Upgrade FastMCP to 3.2.0 or later, which restricts server names to [A-Za-z0-9-_. ] and blocks metacharacters.
- →Until upgraded, manually review any MCP server name before running 'fastmcp install claude-code' or 'fastmcp install gemini-cli', rejecting any name containing & | > ^ ( ).
- →Treat MCP server configuration files (JSON/YAML) from untrusted or external sources as executable input, not inert metadata, and validate them before use.
- →Avoid running FastMCP install commands in automated pipelines against server definitions sourced from third parties without a validation step.
Known benign look-alikes
- Security advisory text quoting the CVE-2025-64340 PoC payload for documentation purposes.
- MCP server names that are legitimate shell scripts being discussed in educational content.
- Escaped/quoted server names in a context that clearly does not flow to a FastMCP installer.