CVE-2026-105788: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in microsoft UFO

Microsoft UFO is an open-source automation framework. Versions before 3.0.10 have a command injection vulnerability (CWE-78) in the type_text and launch_app tools located in ufo/client/mcp/http_servers/mobile_mcp_server.py. These tools pass authenticated caller-controlled parameters (text and package_name) directly into adb shell command arguments without comprehensive validation. The adb client concatenates these arguments into a remote command string, which the Android shell reparses, enabling injection of additional shell commands. Exploitation requires a valid Mobile MCP API key and a reachable authorized device. The vulnerability does not allow execution beyond Android shell user privileges and does not affect the host OS or require root access. The vulnerability is resolved in UFO version 3.0.10.

Successful exploitation allows an attacker with a valid Mobile MCP API key and access to an authorized Android device to execute arbitrary shell commands on that device with Android shell user privileges. This can lead to compromise of the device's data and operations accessible to the shell user. There is no impact on the host operating system or escalation to root privileges. The vulnerability has a high CVSS score of 8.8, reflecting the potential for high confidentiality, integrity, and availability impact within the Android shell context.

Upgrade Microsoft UFO to version 3.0.10 or later, where this vulnerability is fixed. No other mitigation is required as the fix addresses the improper input validation that leads to command injection.