{"id":"CVE-2026-117559","kind":"vulnerability","aliases":["CVE-2026-117559"],"related":[],"title":"DroidMind: MCP clients bypass shell allowlist via command substitution","description":"DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command allowlist by using $(...) or backtick substitution. Attackers, including prompt-injected agents, can inject commands through parameters interpolated into Device.run_shell() or unvalidated Device.list_directory() to run blocked commands such as reboot on connected Android devices.","summary":"DroidMind through 0.4.0 lets MCP clients slip $(...) or backtick substitutions past its shell command allowlist. An attacker, including a prompt-injected agent, can run blocked commands such as reboot on connected Android devices.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","android","droidmind","mcp"],"not_affected_if":["no-android-devices","no-mcp-clients"],"how_to_check":"- Check the installed DroidMind version with `pip show droidmind` (or the equivalent for your install method) and see whether it is `0.4.0` or earlier.\n- Look for MCP setups that expose DroidMind's `Device.run_shell()` or `Device.list_directory()` tools to agents or untrusted clients.","fix":"- Upgrade DroidMind to a version later than `0.4.0`; the fixed version is unknown from the sources.\n- Until patched, remove DroidMind from agent-facing MCP configs or restrict connected devices to test hardware.","status":"open","published_at":"2026-10-27T14:16:37+00:00","first_seen_at":"2026-10-27T14:32:19+00:00","triaged_at":"2026-10-27T14:32:53+00:00","updated_at":"2026-10-27T14:32:53+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-27T14:32:53Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade DroidMind to a version later than `0.4.0`; the fixed version is unknown from the sources.\n- Until patched, remove DroidMind from agent-facing MCP configs or restrict connected devices to test hardware.","reach":"unknown","title":"DroidMind: MCP clients bypass shell allowlist via command substitution","impact":"medium","summary":"DroidMind through 0.4.0 lets MCP clients slip $(...) or backtick substitutions past its shell command allowlist. An attacker, including a prompt-injected agent, can run blocked commands such as reboot on connected Android devices.","category":"ai-tooling","nicknames":[],"who_cares":["mcp","android","droidmind","ai-agents"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs blocked shell commands on connected Android devices.","analyst_note":"Confirm the fixed DroidMind version and whether MCP client access requires authentication, via the NVD entry and the project's repository.","how_to_check":"- Check the installed DroidMind version with `pip show droidmind` (or the equivalent for your install method) and see whether it is `0.4.0` or earlier.\n- Look for MCP setups that expose DroidMind's `Device.run_shell()` or `Device.list_directory()` tools to agents or untrusted clients.","needs_analyst":true,"not_affected_if":["no-mcp-clients","no-android-devices"],"who_is_affected":"Teams that run DroidMind as an MCP server connected to Android devices, especially where AI agents or other MCP clients can call its shell or directory tools. Setups that do not expose DroidMind to MCP clients, or that have no devices attached, are less exposed; the sources do not say more.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000656,"input_tokens":3348,"output_tokens":642,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-117559':12A,15A '-2026':11A,14A '0.4.0':27B,61C 'agent':18B,47B,87C 'ai':17B,20B 'ai-ag':16B 'ai-tool':19B 'allow':68C 'allowlist':6A,39B,76C 'android':22B,57B,110C 'attack':41B,82C 'backtick':33B,80C 'block':50B,103C 'bypass':4A,72C 'client':3A,30B,70C 'command':8A,38B,51B,64C,75C,90C,104C 'connect':56B,109C 'contain':62C 'cve':10A,13A 'devic':58B,111C 'device.list':99C 'device.run':95C 'directori':100C 'droidmind':1A,23B,25B,59C 'includ':42B,83C 'inject':46B,65C,86C,89C 'interpol':93C 'let':28B 'mcp':2A,24B,29B,69C 'paramet':92C 'past':35B 'prompt':45B,85C 'prompt-inject':44B,84C 'reboot':54B,107C 'run':49B,102C 'shell':5A,37B,74C,96C 'slip':31B 'substitut':9A,34B,81C 'tool':21B 'unvalid':98C 'use':78C 'via':7A 'vulner':66C","nicknames":[],"mitigations":[],"who_affected":"Teams that run DroidMind as an MCP server connected to Android devices, especially where AI agents or other MCP clients can call its shell or directory tools. Setups that do not expose DroidMind to MCP clients, or that have no devices attached, are less exposed; the sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117559","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117559","severity":null,"published_at":"2026-10-27T14:16:37+00:00","modified_at":"2026-10-27T14:16:37+00:00","first_seen_at":"2026-10-27T14:32:19+00:00","fetched_at":"2026-10-27T14:32:19+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}