CVE-2026-105793

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the presskey tool in ufo/client/mcp/httpservers/mobilemcpserver.py accepts a free-form keycode parameter and passes it to adb shell input keyevent. The adb client joins the arguments...

CVE-2026-105793 Microsoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key`

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the presskey tool in ufo/client/mcp/httpservers/mobilemcpserver.py accepts a free-form keycode parameter and passes it to adb shell input keyevent. The adb client joins the arguments...

CVE-2026-105793

The Microsoft UFO open-source framework is vulnerable to an authenticated Android shell command injection in the press_key tool within ufo/client/mcp/http_servers/mobile_mcp_server.py prior to version 3.0.9 . The root cause is the handling of a free-form key_code parameter, which is passed to adb...

CVE-2026-105793 Microsoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key`

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the presskey tool in ufo/client/mcp/httpservers/mobilemcpserver.py accepts a free-form keycode parameter and passes it to adb shell input keyevent. The adb client joins the arguments...

EUVD-2026-93421

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the presskey tool in ufo/client/mcp/httpservers/mobilemcpserver.py accepts a free-form keycode parameter and passes it to adb shell input keyevent. The adb client joins the arguments...