CVE-2026-7220 Details
Description
A vulnerability has been found in jackwrichards FastlyMCP up to 6f3d0b0e654fc51076badc7fa16c03c461f95620. This impacts an unknown function of the file fastly-mcp.mjs of the component fastly_cli Tool. The manipulation of the argument command leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
A command injection vulnerability has been identified in jackwrichards FastlyMCP versions prior to 6f3d0b0e654fc51076badc7fa16c03c461f95620. The issue resides in the fastly-mcp.mjs file, within the fastly_cli tool component. The vulnerability allows for arbitrary OS command execution by manipulating the 'command' argument, with the injection being executed through PowerShell. This vulnerability can be exploited remotely, without any authentication requirements.
It is recommended to remove the ability for the 'fastly_cli' tool to execute arbitrary commands via the command line. Instead, implement a fixed allowlist of supported Fastly subcommands with strict argument validation. Avoid using 'child_process.exec' with interpolated strings; opt for direct array-based execution with explicit command definitions.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 28, 2026CISA-ADP
Assessed Apr 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jackwrichards/FastlyMCP/ | [email protected] | Source CodeVendor |
| https://github.com/jackwrichards/FastlyMCP/issues/3 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/submit/802138 | [email protected] | Technical Description |
| https://vuldb.com/vuln/359820 | [email protected] | AdvisoryExploitPartial Content |
| https://vuldb.com/vuln/359820/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| jackwrichards FastlyMCP | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 28, 2026 | New CVE Received | [email protected] |