---
title: FastMCP client RCE: a malicious MCP server can run Python in your client by sending a crafted tool outputSchema, and the call still looks successful; update to 3.4.8 or 4.0.11 | ctxsec
url: https://ctxsec.com/items/fastmcp-client-outputschema-rce-ghsa-gpgx
description: ""
status: "confirmed (FastMCP GitHub advisory GHSA-gpgx-58w2-xwwf, critical, Oct 16); no CVE listed"
published: 2026-10-20
---

> 

[← Context & Harness Attacks](/context) · [markdown](/items/fastmcp-client-outputschema-rce-ghsa-gpgx.md)

confirmed (FastMCP GitHub advisory GHSA-gpgx-58w2-xwwf, critical, Oct 16); no CVE listed

2026-10-20

### FastMCP client RCE: a malicious MCP server can run Python in your client by sending a crafted tool outputSchema, and the call still looks successful; update to 3.4.8 or 4.0.11

FastMCP's maintainers published a **critical** advisory (GHSA-gpgx-58w2-xwwf) on Oct 16. When a FastMCP _client_ parses a successful structured tool result, the self-reference (`$ref: "#"`) branch of its JSON-schema converter passes the server-supplied schema `title` straight to a Python `ForwardRef`, which Pydantic then evaluates. A server that returns a crafted `outputSchema` can therefore run code with the client process's privileges. The surrounding exception handler only logs, so the tool call still returns normally and nothing signals that code ran. The advisory includes a working PoC over both in-memory and HTTP transports. It also flags server-controlled form elicitation schemas as a second path that goes through the same converter.

**Affected:** `fastmcp` >= 2.10.0 and < 3.4.8, and 4.0.0a1 to < 4.0.11. **Fixed:** 3.4.8 and 4.0.11. No 2.x fix is listed, so 2.x users must move to 3.4.8 or later. No CVE is listed on the advisory.

**Why it matters:** this flips the usual MCP threat model. Here the _server_ attacks the _client_ through ordinary protocol metadata, with no prompt injection needed. Any agent, IDE plugin or backend that uses the FastMCP client to talk to third-party or user-supplied MCP servers is exposed. **Do now:** run `pip show fastmcp` (and check lockfiles and container images) and upgrade. Until you have, connect only to MCP servers you control, and run MCP clients in a sandbox without access to your home directory, cloud credentials or SSH keys.

Sources: [FastMCP advisory GHSA-gpgx-58w2-xwwf](https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-gpgx-58w2-xwwf)