Executive brief
The android-mcp-server is a bridge tool that allows AI systems to interact with Android devices via ADB (Android Debug Bridge). A vulnerability in command execution allows attackers to inject arbitrary OS commands through unsanitized parameters, potentially enabling full system compromise on the host machine running the server.
Technical details
The vulnerability is a classic OS command injection flaw in the child_process.exec() call within build/index.js. Multiple parameters (deviceId, packageName, permission, and extras array key/value fields) are not properly sanitized before being passed to shell command execution. An attacker with local access can manipulate these parameters to break out of the intended command context and execute arbitrary OS commands. The attack vector is local-only, and a patch has been identified at commit 14e2bf27c88ba137e35cbb0c2a75f72b595bb98a.
Affected products
- jiantao88 android-mcp-server up to cfb872b2446794193b58edd63f4dbf6af48a6292
Timeline
- 2026-08-17: disclosed
- 2026-08-17: patched: Patch commit 14e2bf27c88ba137e35cbb0c2a75f72b595bb98a available