CVE-2025-59834 (GCVE-0-2025-59834)
Vulnerability from cvelistv5 – Published: 2025-09-25 13:41 – Updated: 2025-09-25 14:36
VLAI
EPSS
VEX
Title
Command Injection in adb-mcp MCP Server
Summary
ADB MCP Server is a MCP (Model Context Protocol) server for interacting with Android devices through ADB. In versions 0.1.0 and prior, the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. This issue has been patched via commit 041729c.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-25 14:36 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/srmorete/adb-mcp/security/advi… | x_refsource_CONFIRM |
| https://github.com/srmorete/adb-mcp/commit/041729… | x_refsource_MISC |
| https://github.com/srmorete/adb-mcp/blob/master/s… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-59834",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-25T14:36:09.518535Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-25T14:36:27.801Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/srmorete/adb-mcp/security/advisories/GHSA-54j7-grvr-9xwg"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "adb-mcp",
"vendor": "srmorete",
"versions": [
{
"status": "affected",
"version": "\u003c= 0.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ADB MCP Server is a MCP (Model Context Protocol) server for interacting with Android devices through ADB. In versions 0.1.0 and prior, the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. This issue has been patched via commit 041729c."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-25T13:41:15.676Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/srmorete/adb-mcp/security/advisories/GHSA-54j7-grvr-9xwg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/srmorete/adb-mcp/security/advisories/GHSA-54j7-grvr-9xwg"
},
{
"name": "https://github.com/srmorete/adb-mcp/commit/041729c0b25432df3199ff71b3163a307cf4c28c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/srmorete/adb-mcp/commit/041729c0b25432df3199ff71b3163a307cf4c28c"
},
{
"name": "https://github.com/srmorete/adb-mcp/blob/master/src/index.ts#L334-L355",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/srmorete/adb-mcp/blob/master/src/index.ts#L334-L355"
}
],
"source": {
"advisory": "GHSA-54j7-grvr-9xwg",
"discovery": "UNKNOWN"
},
"title": "Command Injection in adb-mcp MCP Server"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-59834",
"datePublished": "2025-09-25T13:41:15.676Z",
"dateReserved": "2025-09-22T14:34:03.471Z",
"dateUpdated": "2025-09-25T14:36:27.801Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2025-59834",
"date": "2026-11-08",
"epss": "0.02604",
"percentile": "0.85473"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "adb-mcp",
"vendor": "srmorete",
"versions": [
{
"status": "affected",
"version": "\u003c= 0.1.0"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:srmorete:adb_mcp_server:*:*:*:*:*:node.js:*:*",
"matchCriteriaId": "8BC0C798-F78B-4684-BC7E-8DCD4485EF86",
"versionEndIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "ADB MCP Server is a MCP (Model Context Protocol) server for interacting with Android devices through ADB. In versions 0.1.0 and prior, the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. This issue has been patched via commit 041729c."
},
{
"lang": "es",
"value": "El Servidor ADB MCP es un servidor MCP (Protocolo de Contexto de Modelo) para interactuar con dispositivos Android a trav\u00e9s de ADB. En las versiones 0.1.0 y anteriores, el Servidor MCP est\u00e1 escrito de una manera que es vulnerable a ataques de vulnerabilidad de inyecci\u00f3n de comandos como parte de algunas de sus definiciones e implementaciones de herramientas del Servidor MCP. Este problema ha sido parcheado mediante el commit 041729c."
}
],
"id": "CVE-2025-59834",
"lastModified": "2026-10-11T20:10:00.200",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-59834",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-25T14:36:09.518535Z",
"version": "2.0.3"
}
}
]
},
"published": "2025-09-25T14:15:46.357",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Product"
],
"url": "https://github.com/srmorete/adb-mcp/blob/master/src/index.ts#L334-L355"
},
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/srmorete/adb-mcp/commit/041729c0b25432df3199ff71b3163a307cf4c28c"
},
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/srmorete/adb-mcp/security/advisories/GHSA-54j7-grvr-9xwg"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/srmorete/adb-mcp/security/advisories/GHSA-54j7-grvr-9xwg"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-77"
},
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
},
"redhat_vex": {
"current_release_date": "2025-09-26T13:47:44+00:00",
"cve": "CVE-2025-59834",
"id": "CVE-2025-59834",
"initial_release_date": "2025-01-01T00:00:00+00:00",
"product_status:known_not_affected": "1",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "Command Injection in adb-mcp MCP Server",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-59834.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-59834",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-25T14:36:09.518535Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-25T14:36:24.461Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/srmorete/adb-mcp/security/advisories/GHSA-54j7-grvr-9xwg"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "adb-mcp",
"vendor": "srmorete",
"versions": [
{
"status": "affected",
"version": "\u003c= 0.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ADB MCP Server is a MCP (Model Context Protocol) server for interacting with Android devices through ADB. In versions 0.1.0 and prior, the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. This issue has been patched via commit 041729c."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-25T13:41:15.676Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/srmorete/adb-mcp/security/advisories/GHSA-54j7-grvr-9xwg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/srmorete/adb-mcp/security/advisories/GHSA-54j7-grvr-9xwg"
},
{
"name": "https://github.com/srmorete/adb-mcp/commit/041729c0b25432df3199ff71b3163a307cf4c28c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/srmorete/adb-mcp/commit/041729c0b25432df3199ff71b3163a307cf4c28c"
},
{
"name": "https://github.com/srmorete/adb-mcp/blob/master/src/index.ts#L334-L355",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/srmorete/adb-mcp/blob/master/src/index.ts#L334-L355"
}
],
"source": {
"advisory": "GHSA-54j7-grvr-9xwg",
"discovery": "UNKNOWN"
},
"title": "Command Injection in adb-mcp MCP Server"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-59834",
"datePublished": "2025-09-25T13:41:15.676Z",
"dateReserved": "2025-09-22T14:34:03.471Z",
"dateUpdated": "2025-09-25T14:36:27.801Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
FKIE_CVE-2025-59834
Vulnerability from fkie_nvd - Published: 2025-09-25 14:15 - Updated: 2026-10-11 20:10
Severity
Summary
ADB MCP Server is a MCP (Model Context Protocol) server for interacting with Android devices through ADB. In versions 0.1.0 and prior, the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. This issue has been patched via commit 041729c.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| srmorete | adb_mcp_server | * |
{
"affected": [
{
"affectedData": [
{
"product": "adb-mcp",
"vendor": "srmorete",
"versions": [
{
"status": "affected",
"version": "\u003c= 0.1.0"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:srmorete:adb_mcp_server:*:*:*:*:*:node.js:*:*",
"matchCriteriaId": "8BC0C798-F78B-4684-BC7E-8DCD4485EF86",
"versionEndIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "ADB MCP Server is a MCP (Model Context Protocol) server for interacting with Android devices through ADB. In versions 0.1.0 and prior, the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. This issue has been patched via commit 041729c."
},
{
"lang": "es",
"value": "El Servidor ADB MCP es un servidor MCP (Protocolo de Contexto de Modelo) para interactuar con dispositivos Android a trav\u00e9s de ADB. En las versiones 0.1.0 y anteriores, el Servidor MCP est\u00e1 escrito de una manera que es vulnerable a ataques de vulnerabilidad de inyecci\u00f3n de comandos como parte de algunas de sus definiciones e implementaciones de herramientas del Servidor MCP. Este problema ha sido parcheado mediante el commit 041729c."
}
],
"id": "CVE-2025-59834",
"lastModified": "2026-10-11T20:10:00.200",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-59834",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-25T14:36:09.518535Z",
"version": "2.0.3"
}
}
]
},
"published": "2025-09-25T14:15:46.357",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Product"
],
"url": "https://github.com/srmorete/adb-mcp/blob/master/src/index.ts#L334-L355"
},
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/srmorete/adb-mcp/commit/041729c0b25432df3199ff71b3163a307cf4c28c"
},
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/srmorete/adb-mcp/security/advisories/GHSA-54j7-grvr-9xwg"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/srmorete/adb-mcp/security/advisories/GHSA-54j7-grvr-9xwg"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-77"
},
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
GHSA-54J7-GRVR-9XWG
Vulnerability from github – Published: 2025-09-24 18:59 – Updated: 2025-09-26 16:29
VLAI
Summary
Command Injection in adb-mcp MCP Server
Details
Command Injection in adb-mcp MCP Server
The MCP Server at https://github.com/srmorete/adb-mcp is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation.
The MCP Server is also published publicly to npm at www.npmjs.com/package/adb-mcp and allows users to install it.
Vulnerable tool
The MCP Server defines the function executeAdbCommand() which executes commands via string as a parameter and wraps the promise-based exec function.
The MCP Server then exposes the tool inspect_ui which relies on Node.js child process API exec (through the function wrapper) to execute the Android debugging command (adb). Relying on exec is an unsafe and vulnerable API if concatenated with untrusted user input.
Data flows from the tool definition here which takes in args.device and calls execPromise() in this definitino that uses exec in an insecure way.
Vulnerable line of code: https://github.com/srmorete/adb-mcp/blob/master/src/index.ts#L334-L352
// Add adb UI dump tool
server.tool(
"inspect_ui",
AdbUidumpSchema.shape,
async (args: z.infer<typeof AdbUidumpSchema>, _extra: RequestHandlerExtra) => {
log(LogLevel.INFO, "Dumping UI hierarchy");
const deviceArg = formatDeviceArg(args.device);
const tempFilePath = createTempFilePath("adb-mcp", "window_dump.xml");
const remotePath = args.outputPath || "/sdcard/window_dump.xml";
try {
// Dump UI hierarchy on device
const dumpCommand = `adb ${deviceArg}shell uiautomator dump ${remotePath}`;
await execPromise(dumpCommand);
// Pull the UI dump from the device
const pullCommand = `adb ${deviceArg}pull ${remotePath} ${tempFilePath}`;
await execPromise(pullCommand);
// Clean up the remote file
await execPromise(`adb ${deviceArg}shell rm ${remotePath}`);
The argument to the tool, AdbDevicesSchema, is a Zod inferred type defined in the src/types.ts file in the project:
export const inspectUiInputSchema = {
device: z.string().optional().describe("Specific device ID (optional)"),
outputPath: z.string().optional().describe("Custom output path on device (default: /sdcard/window_dump.xml)"),
asBase64: z.boolean().optional().default(false).describe("Return XML content as base64 (default: false)")
};
and exposes device as a string which is an open way to trick the LLM into pushing arbitrary strings into it and hence achieve the command injection exploitation.
Exploitation
When LLMs are tricked through prompt injection (and other techniques and attack vectors) to call the tool with input that uses special shell characters such as ; rm -rf /tmp;# (be careful actually executing this payload) and other payload variations, the full command-line text will be interepted by the shell and result in other commands except of ps executing on the host running the MCP Server.
Reference example from prior security research on this topic, demonstrating how a similarly vulnerable MCP Server connected to Cursor is abused with prompt injection to bypass the developer's intended command:
Impact
User initiated and remote command injection on a running MCP Server.
Recommendation
- Don't use
exec. UseexecFileinstead, which pins the command and provides the arguments as array elements. - If the user input is not a command-line flag, use the
--notation to terminate command and command-line flag, and indicate that the text after the--double dash notation is benign value.
References and Prior work
- Command Injection in codehooks-mcp-server MCP Server project https://www.nodejs-security.com/blog/command-injection-vulnerability-codehooks-mcp-server-security-analysis identified as CVE-2025-53100
- Command Injection in ios-simulator-mcp-server MCP Server project https://www.nodejs-security.com/blog/ios-simulator-mcp-server-command-injection-vulnerability identified as CVE-2025-52573
- Liran's Node.js Secure Coding: Defending Against Command Injection Vulnerabilities
Credit
Disclosed by Liran Tal
Severity
9.8 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "adb-mcp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-59834"
],
"database_specific": {
"cwe_ids": [
"CWE-77",
"CWE-78"
],
"github_reviewed": true,
"github_reviewed_at": "2025-09-24T18:59:22Z",
"nvd_published_at": "2025-09-25T14:15:46Z",
"severity": "CRITICAL"
},
"details": "# Command Injection in adb-mcp MCP Server\n\nThe MCP Server at https://github.com/srmorete/adb-mcp is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation.\n\nThe MCP Server is also published publicly to npm at www.npmjs.com/package/adb-mcp and allows users to install it.\n\n## Vulnerable tool\n\nThe MCP Server defines the function `executeAdbCommand()` which executes commands via string as a parameter and wraps the promise-based `exec` function.\n\nThe MCP Server then exposes the tool `inspect_ui` which relies on Node.js child process API `exec` (through the function wrapper) to execute the Android debugging command (`adb`). Relying on `exec` is an unsafe and vulnerable API if concatenated with untrusted user input.\n\nData flows from the tool definition [here](https://github.com/srmorete/adb-mcp/blob/master/src/index.ts#L334-L343) which takes in `args.device` and calls `execPromise()` in [this definitino](https://github.com/srmorete/adb-mcp/blob/master/src/index.ts#L346-L348C13) that uses `exec` in an insecure way.\n\nVulnerable line of code: [https://github.com/srmorete/adb-mcp/blob/master/src/index.ts#L334-L352](https://github.com/srmorete/adb-mcp/blob/master/src/index.ts#L334-L355)\n\n```js\n// Add adb UI dump tool\nserver.tool(\n \"inspect_ui\",\n AdbUidumpSchema.shape,\n async (args: z.infer\u003ctypeof AdbUidumpSchema\u003e, _extra: RequestHandlerExtra) =\u003e {\n log(LogLevel.INFO, \"Dumping UI hierarchy\");\n \n const deviceArg = formatDeviceArg(args.device);\n const tempFilePath = createTempFilePath(\"adb-mcp\", \"window_dump.xml\");\n const remotePath = args.outputPath || \"/sdcard/window_dump.xml\";\n \n try {\n // Dump UI hierarchy on device\n const dumpCommand = `adb ${deviceArg}shell uiautomator dump ${remotePath}`;\n await execPromise(dumpCommand);\n \n // Pull the UI dump from the device\n const pullCommand = `adb ${deviceArg}pull ${remotePath} ${tempFilePath}`;\n await execPromise(pullCommand);\n \n // Clean up the remote file\n await execPromise(`adb ${deviceArg}shell rm ${remotePath}`);\n```\n\nThe argument to the tool, `AdbDevicesSchema`, is a Zod inferred type defined in the `src/types.ts` file in the project:\n\n```js\nexport const inspectUiInputSchema = {\n device: z.string().optional().describe(\"Specific device ID (optional)\"),\n outputPath: z.string().optional().describe(\"Custom output path on device (default: /sdcard/window_dump.xml)\"),\n asBase64: z.boolean().optional().default(false).describe(\"Return XML content as base64 (default: false)\")\n};\n```\n\nand exposes `device` as a string which is an open way to trick the LLM into pushing arbitrary strings into it and hence achieve the command injection exploitation.\n\n\n## Exploitation\n\nWhen LLMs are tricked through prompt injection (and other techniques and attack vectors) to call the tool with input that uses special shell characters such as `; rm -rf /tmp;#` (be careful actually executing this payload) and other payload variations, the full command-line text will be interepted by the shell and result in other commands except of `ps` executing on the host running the MCP Server.\n\nReference example from prior security research on this topic, demonstrating how a similarly vulnerable MCP Server connected to Cursor is abused with prompt injection to bypass the developer\u0027s intended command:\n\n\n\n## Impact\n\nUser initiated and remote command injection on a running MCP Server.\n\n## Recommendation\n\n- Don\u0027t use `exec`. Use `execFile` instead, which pins the command and provides the arguments as array elements.\n- If the user input is not a command-line flag, use the `--` notation to terminate command and command-line flag, and indicate that the text after the `--` double dash notation is benign value.\n\n## References and Prior work\n\n1. Command Injection in codehooks-mcp-server MCP Server project https://www.nodejs-security.com/blog/command-injection-vulnerability-codehooks-mcp-server-security-analysis identified as CVE-2025-53100\n2. Command Injection in ios-simulator-mcp-server MCP Server project https://www.nodejs-security.com/blog/ios-simulator-mcp-server-command-injection-vulnerability identified as CVE-2025-52573\n3. Liran\u0027s [Node.js Secure Coding: Defending Against Command Injection Vulnerabilities](https://www.nodejs-security.com/book/command-injection)\n\n## Credit\n\nDisclosed by [Liran Tal](https://lirantal.com)",
"id": "GHSA-54j7-grvr-9xwg",
"modified": "2025-09-26T16:29:51Z",
"published": "2025-09-24T18:59:22Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/srmorete/adb-mcp/security/advisories/GHSA-54j7-grvr-9xwg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59834"
},
{
"type": "WEB",
"url": "https://github.com/srmorete/adb-mcp/commit/041729c0b25432df3199ff71b3163a307cf4c28c"
},
{
"type": "PACKAGE",
"url": "https://github.com/srmorete/adb-mcp"
},
{
"type": "WEB",
"url": "https://github.com/srmorete/adb-mcp/blob/master/src/index.ts#L334-L355"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Command Injection in adb-mcp MCP Server"
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.