Critical · published September 25, 2025
🚨 A sneaky command injection lurks in ADB MCP Server versions 0.1.0 and prior, allowing attackers to control Android devices with a simple trick! 🔥 Think of it like a restaurant where the chef blindly follows any order without checking the menu. If someone slips in a wild request, the kitchen could serve up anything — including something very dangerous! An attacker exploiting this vulnerability could send malicious commands to the Android device, granting them unauthorized control. This could lead to data theft, device manipulation, or worse — a full takeover! This is absolutely devastating for users and their sensitive information.
Think of it like a restaurant where the chef blindly follows any order without checking the menu. If someone slips in a wild request, the kitchen could serve up anything — including something very dangerous! The command injection vulnerability in ADB MCP Server allows attackers to insert arbitrary commands into the MCP Server's tool definitions, compromising the intended security. This flaw exists in versions 0.1.0 and earlier, making it critical to address immediately.
An attacker exploiting this vulnerability could send malicious commands to the Android device, granting them unauthorized control. This could lead to data theft, device manipulation, or worse — a full takeover! This is absolutely devastating for users and their sensitive information. To protect your devices, upgrade ADB MCP Server to the patched version after commit 041729c. Ensure that any deployments using this server are updated, and review your configurations for any custom implementations that might exploit this flaw. You've got this! Update now and you'll be back on track, securing those Android devices! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| srmorete/adb_mcp_server | ≤ 0.1.0 | — |