CVE-2026-81562
Received Received - Intake

Command Injection in claude-in-mobile

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VulDB

Description
A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.10.3 is able to mitigate this issue. The patch is named a86d9e55694c98a122943eeff859461d0b9aa6d6. It is suggested to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-81562
EUVD
EUVD-2026-67004

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
alexgladkov claude-in-mobile 3.10.2
alexgladkov claude-in-mobile 3.10.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-81562 is an OS command injection vulnerability in claude-in-mobile 3.10.2. It occurs in the execSync function of src/adb/client.ts due to improper input validation. Attackers can bypass the denylist by using a standalone ampersand (&) to chain malicious commands, which execute on the host system via shell interpretation. The flaw allows remote code execution at the privilege level of the MCP server process owner.

Detection Guidance

Detecting this vulnerability requires checking if you are running version 3.10.2 of claude-in-mobile. Run 'npm list claude-in-mobile' or check the version in your package.json file. If the version is 3.10.2, the system is vulnerable. Additionally, review the execSync usage in src/adb/client.ts for command injection patterns.

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on your system with the privileges of the MCP server process owner. Potential impacts include file exfiltration, reverse shells, persistence mechanisms, or full system compromise. The attack can occur even without an Android device since the malicious command runs on the host regardless of adb shell success.

Compliance Impact

This vulnerability (CVE-2026-81562) involves OS command injection via improper input validation, allowing attackers to execute arbitrary commands on the host system. This could lead to unauthorized data access, modification, or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information if exploited in regulated environments.

Mitigation Strategies

Immediately upgrade to version 3.10.3 or later of claude-in-mobile. Apply the patch commit a86d9e55694c98a122943eeff859461d0b9aa6d6. Replace execSync with safer alternatives like execFileSync to avoid shell interpretation. Add missing shell metacharacters like & to the denylist as a temporary measure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81562. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart