EUVD-2026-110837
GHSA-533h-cccj-x6hp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain or prompt-inject MCP client access
-
DeliveryCraft parameter with $(...) substitution
-
ExploitBypass shell command allowlist
-
ExecutionInterpolate into Device.run_shell()
-
ImpactExecute blocked command (reboot) on Android device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an actor able to supply parameters to an MCP client connected to DroidMind - either a legitimately connected/authorized MCP client or an AI agent subverted via prompt injection (matching PR:L). The concrete trigger is user-supplied shell-command input interpolated into Device.run_shell(), or input passed to an unvalidated Device.list_directory(), where $(...) or backtick command substitution evades the shell command allowlist. A connected Android device (via ADB) must be present for the executed commands (e.g., reboot) to take effect. Limiting factors: the vector is local (AV:L), not network-remote; it requires MCP-client-level access (PR:L); and it affects only DroidMind deployments at version 0.4.0 or earlier that expose these shell/list functions to client-controlled parameters. |
| Impact | The input CVSS 4.0 vector scores this 8.5 (High) with AV:L/AC:L/AT:N/PR:L/UI:N and VC:H/VI:H/VA:H, meaning full compromise of the affected system but only by an actor who already has local, authenticated access to the DroidMind MCP interface (PR:L). This is not a remote-unauthenticated internet-facing bug. No CISA KEV listing is present (so: not confirmed actively exploited) and no EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified from the input. The vuln.today decision label is 'this_week', not 'act_now' or 'emergency', consistent with a serious-but-not-crisis prioritization. The signals are internally consistent: a straightforward command-injection allowlist bypass (AC:L) with high technical impact, gated behind requiring MCP-client access. The notable amplifier not captured by raw CVSS is the AI-agent threat model - the description explicitly calls out prompt-injected agents as a viable path to 'control over an MCP client', which can lower the practical bar for PR:L in agentic deployments. A GitHub issue reference (#17) and a VulnCheck advisory exist; a public PoC reference therefore exists but is not verified as working exploit code. Net: a real priority for anyone running DroidMind in an agent-connected setup, but its tiny deployment footprint, local vector, and required privilege keep aggregate real-world risk well below what the 8.5 might suggest in isolation. |
| Exploit ScenarioDerived | An attacker who controls or prompt-injects an MCP client connected to DroidMind submits a shell-command parameter containing a $(...) or backtick substitution; the allowlist check fails to detect the nested command, and the value is interpolated into Device.run_shell() (or an unvalidated Device.list_directory()), executing a blocked command such as reboot on the connected Android device. Because the attack vector is local and requires MCP-client privileges (PR:L) with low complexity (AC:L), exploitation is reliable once such access exists. A public PoC reference exists (GitHub issue #17); it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Command injection in DroidMind through 0.4.0 lets a connected MCP client - including an AI agent subverted through prompt injection - slip past the shell-command allowlist and run blocked operations such as reboot on an attached Android device. The weakness sits in parameters interpolated into Device.run_shell() and in the unvalidated Device.list_directory(), where $(...) and backtick substitution are evaluated by the shell rather than by the allowlist check. The assessed vector is AV:L/PR:L, so an attacker must already be able to supply parameters to the DroidMind MCP interface and an ADB-connected device must be present; no public exploit was identified at time of analysis.
RemediationAI
No vendor-released patched version is identified in the available data; the fix status should be tracked through https://github.com/hyperb1iss/droidmind/issues/17 and the VulnCheck advisory at https://www.vulncheck.com/advisories/droidmind-through-0.4.0-command-injection-via-shell-allowlist-bypass, and any release published after 0.4.0 that corrects the allowlist should be adopted as soon as it is confirmed. Until then, the practical mitigations follow directly from the described flaw: remove or gate the Device.run_shell() capability for any MCP client or agent that is not fully trusted, accepting that this eliminates the remote-shell automation the tool exists to provide; reject client-supplied strings containing $( ), backticks and other shell metacharacters before they are interpolated into a command, and avoid constructing shell strings from client parameters at all (pass argument vectors rather than interpolated text) - a change that must be maintained as a local patch since it is not supplied upstream; restrict which MCP clients and AI agents may connect to the DroidMind instance and treat agent output as untrusted input, since a prompt-injected agent is an explicit attack path; and run DroidMind with the least privilege and the narrowest ADB/device exposure possible so that injected commands such as reboot cannot reach production or shared devices. Because the assessed vector is local and requires MCP-client-level access, network-level controls alone will not remove the exposure - the tool surface itself has to be constrained.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
DroidMind is an MCP (Model Context Protocol) server that exposes Android Debug Bridge tooling to MCP clients and AI agents, so that an agent can drive shell and filesystem operations on a tethered Android device. The flaw is CWE-78 (OS command injection). Per the vendor repository, the allowlist logic lives in droidmind/security.py (lines 338-402 at tag v0.4.0) and is intended to block dangerous commands before they reach the device. Because client-controlled parameters are interpolated into command strings that are ultimately handed to a shell, the shell performs command substitution - $(...) and backticks - at execution time, so the command actually executed is never the string the allowlist inspected. Device.list_directory() is separately described as passing unvalidated input down the same path, giving a second entry point that does not depend on the allowlist being consulted at all. The result is that a command the allowlist would reject (the report cites reboot) executes on the connected device. The CPE cpe:2.3:a:hyperb1iss:droidmind:* with EUVD's range of 0 through 0.4.0 marks every release up to and including 0.4.0 as affected; the exposure is scoped to deployments that expose these shell and directory functions to client-supplied parameters, and the underlying trigger conditions are bounded by local, authenticated access to the MCP interface.
Know when Droidmind gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Attacker acts as an authorized/connected MCP client (PR:L) through the local server interface (AV:L); the allowlist bypass is straightforward (AC:L) and yields full shell execution, so C/I/A are High.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command allowlist by using $(...) or backtick substitution. Attackers, including prompt-injected agents, can inject commands through parameters interpolated into Device.run_shell() or unvalidated Device.list_directory() to run blocked commands such as reboot on connected Android devices.
Executive ViewAI
DroidMind, an MCP server for Android device control, contains a command injection flaw (CVE-2026-117559) that lets a connected MCP client-such as an AI agent influenced by prompt injection-bypass the shell-command allowlist and execute blocked operations like reboot on attached devices. This affects teams using DroidMind to automate mobile device testing, where an attacker with access to the MCP interface could disrupt devices or pivot to other restricted actions. Leadership should care because it introduces operational risk to mobile test environments and underscores the need for strict access controls and AI agent oversight.
No vendor-released patch identified at time of analysis. Interim mitigations include: strictly limiting access to the DroidMind MCP interface (e.g., via network segmentation and authentication), implementing input validation and shell-escaping for all parameters passed to Device.run_shell() and Device.list_directory(), disabling the affected functions if not essential, and monitoring for suspicious shell command patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB