Executive brief
The iOS Simulator MCP Server is a tool that allows large language models (LLMs) to automate interactions with iOS simulators. A command injection vulnerability in the ui_tap feature allows attackers to execute arbitrary system commands on the host running the server by crafting malicious input parameters. This could lead to unauthorized code execution, data loss, or system compromise if the server is compromised through prompt injection attacks.
Technical details
The ios-simulator-mcp MCP Server contains an OS command injection vulnerability (CWE-78) in the ui_tap tool implementation. The vulnerable code uses Node.js's unsafe exec() child process API to concatenate untrusted user input (duration, udid, x, y parameters) directly into shell commands without sanitization. An attacker can inject shell metacharacters (e.g., ; or &&) into these parameters to break out of the intended idb command and execute arbitrary commands. Exploitation requires local privileges and user interaction (the LLM must be tricked via prompt injection to call the tool with malicious input). The vulnerability has been patched in version 1.3.3 and later by replacing exec() with safer alternatives.
Affected products
- Joshua Yoes ios-simulator-mcp <1.3.3
Timeline
- 2025-06-26: disclosed
- 2025-06-26: patched: Version 1.3.3 and later