EUVD-2026-60038
GHSA-2wr2-48g3-wphx
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector with low-privilege access required to reach the MCP server; no scope change as impact is confined to the vulnerable system with partial C/I/A impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A flaw has been found in jiantao88 android-mcp-server up to cfb872b2446794193b58edd63f4dbf6af48a6292. The impacted element is the function child_process.exec of the file build/index.js of the component Command Execution. Executing a manipulation of the argument deviceId/packageName/permission/extras[].key/extras[].value can lead to os command injection. It is possible to launch the attack on the local host. The exploit has been published and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. This patch is called 14e2bf27c88ba137e35cbb0c2a75f72b595bb98a. It is advisable to implement a patch to correct this issue.
AnalysisAI
OS command injection in android-mcp-server's build/index.js allows local low-privilege attackers to execute arbitrary shell commands by supplying malicious values for parameters such as deviceId, packageName, permission, or extras fields passed to the child_process.exec() ADB command builder. The vulnerable code interpolates user-supplied input directly into shell command strings without sanitization, making exploitation trivial for any local user with access to the MCP server process. A publicly available proof-of-concept exists via the GitHub issue tracker, and a patch commit has been published; no CISA KEV listing confirms active in-the-wild exploitation at time of analysis.
Technical ContextAI
android-mcp-server is a Node.js-based Model Context Protocol (MCP) server that wraps Android Debug Bridge (ADB) commands for Android device management, identified by CPE cpe:2.3:a:jiantao88:android-mcp-server:*:*:*:*:*:*:*:*. The root cause (CWE-78, OS Command Injection) lies in the use of Node.js child_process.exec() in build/index.js, which passes the full command as a single string to the OS shell (/bin/sh -c). User-supplied values for deviceId, packageName, permission, extras[].key, and extras[].value were interpolated directly into this shell command string - e.g., constructing const cmd = '"' + adbPath + '" ' + deviceOption + ' ' + command - without neutralizing shell metacharacters such as ;, &&, or |. The patch at commit 14e2bf27c88ba137e35cbb0c2a75f72b595bb98a replaces exec() with execFile() (which passes arguments as an array, bypassing shell interpretation entirely), introduces Zod regex-based input validation for packageName and permission fields, and adds a quoteRemoteShellArg() function for safe POSIX escaping of ADB remote shell arguments.
RemediationAI
Update android-mcp-server to the patched commit 14e2bf27c88ba137e35cbb0c2a75f72b595bb98a or any later commit by pulling from the repository at https://github.com/jiantao88/android-mcp-server/; the specific patch diff is available at https://github.com/jiantao88/android-mcp-server/commit/14e2bf27c88ba137e35cbb0c2a75f72b595bb98a. Because the project has no versioned releases, operators must manually verify that their deployed commit hash is at or after the patch baseline. As a compensating control where immediate patching is not possible, restrict OS-level access to the system running android-mcp-server to trusted developer accounts only, reducing the attacker population; note this does not eliminate the underlying flaw and should not be treated as a permanent mitigation. Do not deploy this tool in shared or multi-user environments without first applying the patch.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today