CVE-2026-19978
Received Received - Intake

Command Injection in jiantao88 Android MCP Server

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulDB

Description
A flaw has been found in jiantao88 android-mcp-server up to cfb872b2446794193b58edd63f4dbf6af48a6292. The impacted element is the function child_process.exec of the file build/index.js of the component Command Execution. Executing a manipulation of the argument deviceId/packageName/permission/extras[].key/extras[].value can lead to os command injection. It is possible to launch the attack on the local host. The exploit has been published and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. This patch is called 14e2bf27c88ba137e35cbb0c2a75f72b595bb98a. It is advisable to implement a patch to correct this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-19978
EUVD
EUVD-2026-60038

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jiantao88 android_mcp_server to cfb872b2446794193b58edd63f4dbf6af48a6292 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an OS command injection flaw in the jiantao88 android-mcp-server. It occurs in the child_process.exec function of build/index.js where user-controlled inputs like deviceId, packageName, permission, extras[].key, or extras[].value are directly used in shell commands without proper sanitization. Attackers can manipulate these inputs to inject malicious commands, such as executing arbitrary programs like calc.exe, even without a connected Android device.

Detection Guidance

Check if you are running a vulnerable version of jiantao88 android-mcp-server by inspecting the installed package version or commit hash. Look for unsanitized ADB command execution in the server's code, particularly in build/index.js where child_process.exec is used without proper input validation.

Impact Analysis

If you use the affected android-mcp-server, an attacker could exploit this flaw to execute arbitrary commands on your local system. This could lead to unauthorized access, data theft, installation of malware, or disruption of services. The attack is possible even without a physical Android device connected, as the vulnerability affects the server's command execution on the host machine.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using the affected software may face compliance violations, legal penalties, and reputational damage due to potential exposure of sensitive data.

Mitigation Strategies

Update to the patched version 14e2bf27c88ba137e35cbb0c2a75f72b595bb98a which includes proper shell argument quoting and escaping. If updating is not possible, disable the server or restrict access to trusted clients only. Review all ADB command execution paths to ensure user input is properly sanitized before being passed to shell commands.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19978. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart