Droidmind
Monthly
Command injection in DroidMind through 0.4.0 lets a connected MCP client - including an AI agent subverted through prompt injection - slip past the shell-command allowlist and run blocked operations such as reboot on an attached Android device. The weakness sits in parameters interpolated into Device.run_shell() and in the unvalidated Device.list_directory(), where $(...) and backtick substitution are evaluated by the shell rather than by the allowlist check. The assessed vector is AV:L/PR:L, so an attacker must already be able to supply parameters to the DroidMind MCP interface and an ADB-connected device must be present; no public exploit was identified at time of analysis.
Command injection in DroidMind through 0.4.0 lets a connected MCP client - including an AI agent subverted through prompt injection - slip past the shell-command allowlist and run blocked operations such as reboot on an attached Android device. The weakness sits in parameters interpolated into Device.run_shell() and in the unvalidated Device.list_directory(), where $(...) and backtick substitution are evaluated by the shell rather than by the allowlist check. The assessed vector is AV:L/PR:L, so an attacker must already be able to supply parameters to the DroidMind MCP interface and an ADB-connected device must be present; no public exploit was identified at time of analysis.