CVE-2026-117559
Received Received - Intake

Command Injection in DroidMind Through 0.4.0

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: VulnCheck

Description
DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command allowlist by using $(...) or backtick substitution. Attackers, including prompt-injected agents, can inject commands through parameters interpolated into Device.run_shell() or unvalidated Device.list_directory() to run blocked commands such as reboot on connected Android devices.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-117559
EUVD
EUVD-2026-110837

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hyperb1iss droidmind 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

DroidMind through version 0.4.0 has a command injection flaw. It allows MCP clients to bypass shell command restrictions using $(...) or backtick substitution. Attackers can inject commands via parameters in Device.run_shell() or unvalidated Device.list_directory() to execute blocked commands like reboot on connected Android devices.

Detection Guidance

Check for unusual shell command execution patterns in logs, especially those involving $(...) or backtick substitution in parameters passed to Device.run_shell() or Device.list_directory(). Monitor network traffic for unexpected reboots or unauthorized device commands.

Impact Analysis

This vulnerability allows attackers to execute unauthorized commands on connected Android devices. This could lead to system disruption, unauthorized access, or control over the device. Users may experience unexpected reboots or other malicious actions.

Mitigation Strategies

Update DroidMind to the latest version beyond 0.4.0. Disable or restrict access to Device.run_shell() and Device.list_directory() functions. Implement strict input validation for all parameters passed to these functions. Review and audit shell command allowlists to ensure no bypasses exist.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-117559. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart