---
id: "CVE-2026-117559"
kind: "vulnerability"
aliases: ["CVE-2026-117559"]
title: "DroidMind: MCP clients bypass shell allowlist via command substitution"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-agents", "ai-tooling", "android", "droidmind", "mcp"]
not_affected_if: ["no-android-devices", "no-mcp-clients"]
published_at: "2026-10-27T14:16:37+00:00"
first_seen_at: "2026-10-27T14:32:19+00:00"
updated_at: "2026-10-27T14:32:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117559", "first_seen_at": "2026-10-27T14:32:19+00:00"}]
---

# DroidMind: MCP clients bypass shell allowlist via command substitution

DroidMind through 0.4.0 lets MCP clients slip $(...) or backtick substitutions past its shell command allowlist. An attacker, including a prompt-injected agent, can run blocked commands such as reboot on connected Android devices.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed DroidMind version with `pip show droidmind` (or the equivalent for your install method) and see whether it is `0.4.0` or earlier.
- Look for MCP setups that expose DroidMind's `Device.run_shell()` or `Device.list_directory()` tools to agents or untrusted clients.

## Fix

- Upgrade DroidMind to a version later than `0.4.0`; the fixed version is unknown from the sources.
- Until patched, remove DroidMind from agent-facing MCP configs or restrict connected devices to test hardware.

## Timeline

- 2026-10-27T14:32:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117559

## From the sources

DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command allowlist by using $(...) or backtick substitution. Attackers, including prompt-injected agents, can inject commands through parameters interpolated into Device.run_shell() or unvalidated Device.list_directory() to run blocked commands such as reboot on connected Android devices.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_