Executive brief
MaaMCP is a tool server that provides automation capabilities for AI assistants to control Android and Windows devices. The save_pipeline and load_pipeline functions fail to validate file paths, allowing an attacker to read arbitrary JSON files from the system or write malicious JSON content to any location the server process can access. An attacker can exploit this via prompt injection—delivering malicious instructions within content that the AI processes—to exfiltrate sensitive configuration files or corrupt system files.
Technical details
The vulnerability is a path traversal flaw (CWE-22, CWE-73) in the save_pipeline and load_pipeline tools within pipeline_tools.py. The functions accept file paths directly from callers and pass them unvalidated to Python's open() function, accepting absolute paths, relative paths with "..", and symlinks. An MCP client or prompt-injected LLM can write arbitrary JSON-formatted content to any writable location, or read and exfiltrate the contents of any JSON dictionary file accessible to the server process. The server provides a four-way information oracle: different error messages for "file not found," "not a file," "invalid JSON," and "valid JSON dict," which enables attackers to probe filesystem layout. A patch (commit c93ef45cba75295eba26d9ff1ffb9202a91c6150) is available and should be deployed immediately.
Affected products
- MAA-AI MaaMCP up to 1.1.1.dev6+g2e4a41287
Timeline
- 2026-08-28: disclosed
- 2026-08-28: patched: Patch commit c93ef45cba75295eba26d9ff1ffb9202a91c6150 available