A flaw was found in version 3.10.2 of the AlexGladkov claude‑in‑mobile tool. The deficiency resides in the execSync function within src/adb/client.ts, which allows an attacker who can manipulate input to inject arbitrary operating‑system commands. The resulting vulnerability is a local command‑execution vector that could compromise the host system. This injection flaw is identical to CWE-77 and CWE-78 weaknesses and can be used to run arbitrary scripts or binaries in the context of the user that runs claude‑in‑mobile.

The affected product is AlexGladkov claude‑in‑mobile version 3.10.2. The product is distributed through GitHub and is available for multiple platforms; the vulnerability exists in the client code that calls execSync. Users employing the v3.10.2 release or earlier should view the application as having the flaw. The vendor recommends upgrading to v3.10.3, which removes the vulnerability.

The CVSS score is 4.8, indicating moderate severity. The exploit is local, meaning an attacker must have access to the victim's machine or otherwise be able to influence the input that the tool receives. The exploit has been released publicly, and the corresponding commit that patches the issue can be applied. The EPSS score is not available, and the vulnerability has not been listed in CISA's KEV catalog, so there is no current indication of widespread exploitation. However, because the flaw permits arbitrary command execution on a compromised host, it poses a high potential risk in environments where claude‑in‑mobile is run with elevated privileges.