CVE-2026-117559EUVD-2026-110837GHSA-533H-CCCJ-X6HP
DroidMind through 0.4.0 Command Injection via Shell Allowlist Bypass
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
DroidMind, an MCP server for managing Android devices, is affected by this vulnerability. An attacker, including a prompt-injected AI agent, could bypass the shell command allowlist and run blocked commands such as reboot on connected Android devices.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command allowlist by using $(...) or backtick substitution. Attackers, including prompt-injected agents, can inject commands through parameters interpolated into Device.run_shell() or unvalidated Device.list_directory() to run blocked commands such as reboot on connected Android devices.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- hyperb1iss droidmind
through 0.4.0