CVE-2026-117559

DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command allowlist by using $... or backtick substitution. Attackers, including prompt-injected agents, can inject commands through parameters interpolated into Device.runshell or...

CVE-2026-117559

DroidMind versions through 0.4.0 are susceptible to a command injection vulnerability due to a shell command allowlist bypass. The flaw allows MCP clients to execute unauthorized commands, such as rebooting connected Android devices, by using $(...) or backtick substitution in parameters interpol...

EUVD-2026-110837

DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command allowlist by using $... or backtick substitution. Attackers, including prompt-injected agents, can inject commands through parameters interpolated into Device.runshell or...

CVE-2026-117559 DroidMind through 0.4.0 Command Injection via Shell Allowlist Bypass

DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command allowlist by using $... or backtick substitution. Attackers, including prompt-injected agents, can inject commands through parameters interpolated into Device.runshell or...

PT-2026-126418

DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command allowlist by using $... or backtick substitution. Attackers, including prompt-injected agents, can inject commands through parameters interpolated into Device.run shell or...