CVE-2026-19978: OS Command Injection in jiantao88 android-mcp-server
CVE-2026-19978 is an OS command injection vulnerability in the jiantao88 android-mcp-server component. The flaw exists in the child_process.exec function within build/index.js, where manipulation of certain input arguments can lead to command injection on the local host. Exploit code has been published. The product uses a rolling release model, so specific affected or patched versions are not available. A patch identified by commit 14e2bf27c88ba137e35cbb0c2a75f72b595bb98a is recommended to fix the issue. The CVSS 4.0 base score is 4.8, indicating medium severity.
AI Analysis
Technical Summary
This vulnerability involves OS command injection in the jiantao88 android-mcp-server up to commit cfb872b2446794193b58edd63f4dbf6af48a6292. The vulnerable code is in the child_process.exec function in build/index.js, where manipulation of the deviceId, packageName, permission, or extras[].key/extras[].value arguments can lead to execution of arbitrary OS commands. The attack can be launched locally. Exploit code is publicly available. The product uses a rolling release, so exact affected versions are not specified. A patch exists in commit 14e2bf27c88ba137e35cbb0c2a75f72b595bb98a, and applying it is advised.
Potential Impact
Successful exploitation allows an attacker with local access and low privileges to execute arbitrary OS commands on the host running the android-mcp-server. This can lead to unauthorized command execution with the privileges of the server process. The CVSS 4.0 score of 4.8 reflects a medium severity impact with local attack vector and low privileges required.
Mitigation Recommendations
A patch identified by commit 14e2bf27c88ba137e35cbb0c2a75f72b595bb98a is available and should be applied to remediate this vulnerability. Since the product uses a rolling release model, users should update to the latest version that includes this patch. No vendor advisory was provided to confirm patch status, so users should verify with the vendor or source repository for the latest remediation guidance.
CVE-2026-19978: OS Command Injection in jiantao88 android-mcp-server
Description
CVE-2026-19978 is an OS command injection vulnerability in the jiantao88 android-mcp-server component. The flaw exists in the child_process.exec function within build/index.js, where manipulation of certain input arguments can lead to command injection on the local host. Exploit code has been published. The product uses a rolling release model, so specific affected or patched versions are not available. A patch identified by commit 14e2bf27c88ba137e35cbb0c2a75f72b595bb98a is recommended to fix the issue. The CVSS 4.0 base score is 4.8, indicating medium severity.
CVSS v4.0
Score 4.8medium
Affected software
jiantao88
android-mcp-server
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves OS command injection in the jiantao88 android-mcp-server up to commit cfb872b2446794193b58edd63f4dbf6af48a6292. The vulnerable code is in the child_process.exec function in build/index.js, where manipulation of the deviceId, packageName, permission, or extras[].key/extras[].value arguments can lead to execution of arbitrary OS commands. The attack can be launched locally. Exploit code is publicly available. The product uses a rolling release, so exact affected versions are not specified. A patch exists in commit 14e2bf27c88ba137e35cbb0c2a75f72b595bb98a, and applying it is advised.
Potential Impact
Successful exploitation allows an attacker with local access and low privileges to execute arbitrary OS commands on the host running the android-mcp-server. This can lead to unauthorized command execution with the privileges of the server process. The CVSS 4.0 score of 4.8 reflects a medium severity impact with local attack vector and low privileges required.
Mitigation Recommendations
A patch identified by commit 14e2bf27c88ba137e35cbb0c2a75f72b595bb98a is available and should be applied to remediate this vulnerability. Since the product uses a rolling release model, users should update to the latest version that includes this patch. No vendor advisory was provided to confirm patch status, so users should verify with the vendor or source repository for the latest remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-08-16T13:18:54.073Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a8282f6bf8831d53928bb2a
Added to database: 08/17/2026, 03:41:42 UTC
Last enriched: 08/24/2026, 13:30:02 UTC
Last updated: 10/01/2026, 05:14:48 UTC
Views: 93
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.