Description
DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command allowlist by using $(...) or backtick substitution. Attackers, including prompt-injected agents, can inject commands through parameters interpolated into Device.run_shell() or unvalidated Device.list_directory() to run blocked commands such as reboot on connected Android devices.
Published: 2026-10-27
Score: 8.5 High
EPSS: n/a
KEV: No
Impact: Remote Code Execution via Command Injection
Action: Apply Upgrade
AI Analysis

Impact

DroidMind through 0.4.0 contains a command injection flaw that allows malicious MCP clients to bypass the established shell command allowlist by injecting shell metacharacters such as $(...) or backticks. Parameters supplied to Device.run_shell() and Device.list_directory() are interpolated directly into shell commands without proper sanitization, enabling an attacker to execute arbitrary shell commands against the connected Android device.

Affected Systems

The affected product is hyperb1iss DroidMind, any installation of version 0.4.0 or earlier. The vulnerability affects instances where the MCP client interacts with the Device.run_shell or Device.list_directory methods, which may occur in production or development environments that use DroidMind to manage Android devices.

Risk and Exploitability

The CVSS score of 8.5 indicates high severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers can remotely inject commands and execute blocked operations such as reboot, potentially taking full control of the Android device. The principal exploitation vector is through trusted MCP client connections, but if prompt‑injected agents are present any user could trigger the injection. Due to the lack of an immediate public patch, the risk remains high for any system still running the vulnerable version.

Generated by OpenCVE AI on October 27, 2026 at 14:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Deploy an updated release of DroidMind that removes the allowlist bypass, if available from the vendor.
  • If an update is not immediately available, restrict access so that only trusted MCP clients can interface with devices, blocking untrusted connections.
  • Apply strict input validation or whitelisting to the command parameters in Device.run_shell() and Device.list_directory(), rejecting any strings containing shell metacharacters or allowlist‑bypass patterns.
  • Enable comprehensive logging and monitoring of shell command execution over MCP to detect anomalous behavior and trigger alerts if unexpected commands are run.

Generated by OpenCVE AI on October 27, 2026 at 14:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Description DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command allowlist by using $(...) or backtick substitution. Attackers, including prompt-injected agents, can inject commands through parameters interpolated into Device.run_shell() or unvalidated Device.list_directory() to run blocked commands such as reboot on connected Android devices.
Title DroidMind through 0.4.0 Command Injection via Shell Allowlist Bypass
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-27T13:07:53.788Z

Reserved: 2026-10-27T11:25:22.152Z

Link: CVE-2026-117559

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-27T14:16:37.987

Modified: 2026-10-27T14:16:37.987

Link: CVE-2026-117559

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T14:30:04Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')