CyberRota Analysis
AI-GeneratedThe jiantao88 android-mcp-server is vulnerable to OS command injection due to improper handling of user-supplied arguments in the child_process.exec function, which could allow an attacker to execute arbitrary commands on the local host. This flaw affects all versions up to a specific commit and poses a medium risk, making it crucial for organizations using this software to prioritize patching to mitigate potential exploitation. Users should apply the provided patch (14e2bf27c88ba137e35cbb0c2a75f72b595bb98a) to secure their systems.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw has been found in jiantao88 android-mcp-server up to cfb872b2446794193b58edd63f4dbf6af48a6292. The impacted element is the function child_process.exec of the file build/index.js of the component Command Execution. Executing a manipulation of the argument deviceId/packageName/permission/extras[].key/extras[].value can lead to os command injection. It is possible to launch the attack on the local host. The exploit has been published and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. This patch is called 14e2bf27c88ba137e35cbb0c2a75f72b595bb98a. It is advisable to implement a patch to correct this issue.