A critical OS command injection vulnerability in the FastlyMCP tool allows unauthenticated remote attackers to execute arbitrary code on the host system.

The application is vulnerable to OS command injection (CWE-78) because it passes unsanitized user-controlled input from the command argument in the fastly_cli tool directly to a shell-executed PowerShell command via child_process.exec. This allows an unauthenticated remote attacker to inject arbitrary commands that execute with the privileges of the MCP server process.

Successful exploitation of this vulnerability results in full system compromise, as the attacker can execute arbitrary OS commands with the permissions of the underlying service. This poses a severe risk of data exfiltration, unauthorized access to environment variables and credentials, system disruption, and the potential for establishing persistent backdoors. While the CVSS score is 7.3, the potential for total system takeover suggests that the business impact should be treated with critical urgency.

Immediate Action: Since no official patch is currently available, immediately restrict network access to the FastlyMCP server to trusted internal segments only, or disable the service entirely until a secure version is released.

Proactive Monitoring: Monitor system and process logs for anomalous PowerShell activity, particularly commands spawned by the FastlyMCP process that include unexpected shell metacharacters like semicolons or pipe symbols.

Compensating Controls: Deploy a Web Application Firewall or an API gateway to intercept and block incoming MCP JSON-RPC requests containing suspicious command arguments that attempt to inject PowerShell syntax.

Public Exploit Available: Yes, a published proof-of-concept exists, as detailed in the security researcher's report linked in the project's GitHub issue tracker.

Given the availability of a public proof-of-concept and the high impact of OS command injection, this vulnerability presents a significant risk to any environment hosting the FastlyMCP server. Organizations should prioritize isolating the affected component immediately and closely monitor for unauthorized execution attempts. Security teams must await an official upstream fix and perform a thorough security audit of the deployment before restoring full service functionality.