CVE-2026-105793: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in microsoft UFO

Microsoft UFO is an open-source automation framework. In versions before 3.0.9, the press_key tool in ufo/client/mcp/http_servers/mobile_mcp_server.py accepts a free-form key_code parameter that is passed to `adb shell input keyevent`. The adb client concatenates arguments into a remote command string that the Android shell reparses, enabling an authenticated Mobile MCP caller with a valid UFO_MCP_API_KEY to inject additional commands executed as the Android shell user on an authorized connected device. Exploitation requires the presence of adb on the host, a reachable authorized device, and valid authentication. The vulnerability does not grant host OS execution or Android root privileges. The flaw is addressed in version 3.0.9.

An attacker with valid authentication and access to an authorized Android device can execute arbitrary shell commands on that device with shell user privileges. This can lead to command execution impacting the integrity and availability of the Android device environment. There is no impact on the host operating system or escalation to root privileges on the Android device.

Upgrade Microsoft UFO to version 3.0.9 or later, where this vulnerability is fixed. No additional mitigation is required as the fix addresses the improper input handling that leads to command injection.