Why the FastMCP client treated a tool result's schema name as code

The official FastMCP security advisory GHSA-gpgx-58w2-xwwf disclosed a Critical-severity remote code execution vulnerability in the client; the advisory was published on 16 October 2026 UTC, and the patch had been merged previously. The old implementation's self-referential branch passed the server schema's title, without sanitization, into ForwardRef, and when Pydantic evaluated it, an attacker-supplied expression could execute; triggering requires the attacker to control the MCP server, the client to be permitted to connect and to call a tool that returns a specially crafted schema and non-empty structuredContent. The code runs with the client process's existing privileges, and the vulnerability triggers when parsing the result; it does not require the model to accept malicious instructions, and the article holds that prompt-layer defenses cannot fix this type of program defect. The official demonstration reproduced 3.3.1, 3.4.7 and 4.0.10 under Python 3.11, and the fix also adds limits of 64 levels and 50,000 nodes to schema conversion.