Live › vulnerability › CVE-2026-117559
Go to dashboardDroidMind through 0.4.0 lets MCP clients slip $(...) or backtick substitutions past its shell command allowlist. An attacker, including a prompt-injected agent, can run blocked commands such as reboot on connected Android devices.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Teams that run DroidMind as an MCP server connected to Android devices, especially where AI agents or other MCP clients can call its shell or directory tools. Setups that do not expose DroidMind to MCP clients, or that have no devices attached, are less exposed; the sources do not say more.
No product ranges from the sources yet.
pip show droidmind (or the equivalent for your install method) and see whether it is 0.4.0 or earlier.Device.run_shell() or Device.list_directory() tools to agents or untrusted clients.0.4.0; the fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command allowlist by using $(...) or backtick substitution. Attackers, including prompt-injected agents, can inject commands through parameters interpolated into Device.run_shell() or unvalidated Device.list_directory() to run blocked commands such as reboot on connected Android devices.
This page as .md · .json · in your agent: get_signal("CVE-2026-117559")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.