GHSA-M8X7-R2RG-VH5G FastMCP has a Command Injection vulnerability - Gemini CLI

Server names containing shell metacharacters e.g., & can cause command injection on Windows when passed to fastmcp install claude-code or fastmcp install gemini-cli. These install paths use subprocess.run with a list argument, but on Windows the target CLIs often resolve to .cmd wrappers that are...

CVE-2026-4926 vulnerabilities

Vulnerabilities for packages: saf, thingsboard, tileserver-gl-fips, wazuh-dashboard, vitess, gemini-cli, langfuse-fips, opensearch-dashboards-fips, tileserver-gl, redisinsight, opensearch-dashboards, code-server, langfuse, kibana...

CVE-2026-4923 vulnerabilities

Vulnerabilities for packages: saf, thingsboard, tileserver-gl-fips, wazuh-dashboard, vitess, gemini-cli, langfuse-fips, opensearch-dashboards-fips, tileserver-gl, redisinsight, opensearch-dashboards, code-server, langfuse, kibana...

GHSA-27V5-C462-WPQ7 vulnerabilities

Vulnerabilities for packages: saf, thingsboard, tileserver-gl-fips, wazuh-dashboard, vitess, gemini-cli, langfuse-fips, opensearch-dashboards-fips, tileserver-gl, redisinsight, opensearch-dashboards, code-server, langfuse, kibana...