CVE-2026-19978: OS Command Injection in jiantao88 android-mcp-server
CVE-2026-19978 is an OS command injection vulnerability in the jiantao88 android-mcp-server component. The flaw exists in the child_process.exec function within build/index.js, where manipulation of certain arguments can lead to command injection on the local host. The product uses a rolling release model, so specific affected versions are not available. An exploit has been published, but no confirmed active exploitation is reported. A patch identified by commit 14e2bf27c88ba137e35cbb0c2a75f72b595bb98a is recommended to remediate the issue.
AI Analysis
Technical Summary
This vulnerability in jiantao88 android-mcp-server up to commit cfb872b2446794193b58edd63f4dbf6af48a6292 allows an attacker with local access to execute arbitrary OS commands by manipulating the deviceId, packageName, permission, or extras[].key/extras[].value arguments passed to the child_process.exec function in build/index.js. The product's rolling release model means exact affected versions are not specified. A patch commit 14e2bf27c88ba137e35cbb0c2a75f72b595bb98a addresses this issue. The CVSS 4.0 score is 4.8 (medium severity), reflecting local attack vector with low complexity and no user interaction required. Exploit code has been published but no known active exploitation is confirmed.
Potential Impact
Successful exploitation allows an attacker with local access and low privileges to execute arbitrary OS commands on the affected system. This could lead to unauthorized command execution, potentially compromising system integrity or confidentiality depending on the commands run. The impact is limited by the requirement for local access and the low severity score.
Mitigation Recommendations
A patch identified by commit 14e2bf27c88ba137e35cbb0c2a75f72b595bb98a is available and should be applied to remediate this vulnerability. Since the product uses a rolling release, users should update to the latest version containing this patch. No vendor advisory explicitly states otherwise, so applying the patch is the recommended mitigation.
CVE-2026-19978: OS Command Injection in jiantao88 android-mcp-server
Description
CVE-2026-19978 is an OS command injection vulnerability in the jiantao88 android-mcp-server component. The flaw exists in the child_process.exec function within build/index.js, where manipulation of certain arguments can lead to command injection on the local host. The product uses a rolling release model, so specific affected versions are not available. An exploit has been published, but no confirmed active exploitation is reported. A patch identified by commit 14e2bf27c88ba137e35cbb0c2a75f72b595bb98a is recommended to remediate the issue.
CVSS v4.0
Score 4.8medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in jiantao88 android-mcp-server up to commit cfb872b2446794193b58edd63f4dbf6af48a6292 allows an attacker with local access to execute arbitrary OS commands by manipulating the deviceId, packageName, permission, or extras[].key/extras[].value arguments passed to the child_process.exec function in build/index.js. The product's rolling release model means exact affected versions are not specified. A patch commit 14e2bf27c88ba137e35cbb0c2a75f72b595bb98a addresses this issue. The CVSS 4.0 score is 4.8 (medium severity), reflecting local attack vector with low complexity and no user interaction required. Exploit code has been published but no known active exploitation is confirmed.
Potential Impact
Successful exploitation allows an attacker with local access and low privileges to execute arbitrary OS commands on the affected system. This could lead to unauthorized command execution, potentially compromising system integrity or confidentiality depending on the commands run. The impact is limited by the requirement for local access and the low severity score.
Mitigation Recommendations
A patch identified by commit 14e2bf27c88ba137e35cbb0c2a75f72b595bb98a is available and should be applied to remediate this vulnerability. Since the product uses a rolling release, users should update to the latest version containing this patch. No vendor advisory explicitly states otherwise, so applying the patch is the recommended mitigation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-08-16T13:18:54.073Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a8282f6bf8831d53928bb2a
Added to database: 08/17/2026, 03:41:42 UTC
Last enriched: 08/17/2026, 03:59:35 UTC
Last updated: 08/17/2026, 04:01:05 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.