Skip to content

Back to the catalog

nvd.nist.govadvisory

CVE-2026-19978: A flaw has been found in jiantao88 android-mcp-server up to cfb872b2446794193b58edd63f4dbf6af48a6292

CVE-2026-19978 describes an OS command injection (CWE-77/78) in jiantao88's android-mcp-server, where the child_process.exec call in build/index.js fails to sanitize the deviceId, packageName, permission, and extras[].key/value arguments used to control Android devices. The flaw allows local command execution and has a published exploit; it was fixed in commit 14e2bf27c88ba137e35cbb0c2a75f72b595bb98a. CVSS 4.0 base score is 1.9 (local attack vector only), and the project uses rolling releases so no fixed version numbers are assigned.

TL;DR OS command injection in android-mcp-server's child_process.exec via unsanitized device/package parameters, patched in commit 14e2bf2.
Open original ↗

Organisations named here

  • CWE-77
  • CWE-78

CVEs named here

  • CVE-2026-19978

Technologies named here

  • android-mcp-server
  • Model Context Protocol
  • Android
  • Node.js

Techniques named here

  • OS Command Injection

Related in AppSec