Threats tagged 'brew-mcp-atlassian-cve-2025-64340'

A command injection vulnerability exists in FastMCP when installing the claude-code or gemini-cli tools on Windows. Server names containing shell metacharacters such as '&' can cause arbitrary command execution due to how Windows .cmd wrappers are invoked via cmd.exe. This affects FastMCP versions from 0.11.9 up to but not including 0.23.0. The issue does not affect macOS or Linux, nor config-file-based install targets. The vulnerability is patched in version 0.23.0 by validating server names to reject shell metacharacters.