Threats tagged 'ghsa-533h-cccj-x6hp'

DroidMind versions through 0.4.0 have a command injection vulnerability that allows MCP clients to bypass shell command allowlists using command substitution techniques. This enables attackers to execute unauthorized commands such as reboot on connected Android devices by injecting commands into specific parameters.