Claude In Mobile
Monthly
OS command injection in AlexGladkov claude-in-mobile 3.10.2 allows a local low-privileged attacker to execute arbitrary shell commands by supplying metacharacter-laced parameters to the tool's ADB and iOS simulator CLI subsystem. The Rust CLI modules (android.rs, ios.rs) interpolated caller-supplied strings - package names, permission identifiers, XML filenames, preference keys, SQLite database paths, and relative file paths - directly into device-side sh -c invocations without sanitization. A public proof-of-concept exists (GitHub issue #40), and a vendor-released patch (v3.10.3) is available.
OS command injection in AlexGladkov claude-in-mobile 3.10.2 allows a local low-privileged attacker to execute arbitrary shell commands by supplying metacharacter-laced parameters to the tool's ADB and iOS simulator CLI subsystem. The Rust CLI modules (android.rs, ios.rs) interpolated caller-supplied strings - package names, permission identifiers, XML filenames, preference keys, SQLite database paths, and relative file paths - directly into device-side sh -c invocations without sanitization. A public proof-of-concept exists (GitHub issue #40), and a vendor-released patch (v3.10.3) is available.