CVE-2026-81562CWE-77CWE-78command-injection

CVE-2026-81562

Medium · published August 27, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
64.9
In the wild
Unconfirmed
What it is

A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.10.3 is able to mitigate this issue. The patch is named a86d9e55694c98a122943eeff859461d0b9aa6d6. It is suggested to upgrade the affected component.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
4.8 · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.01083 · 64.9th percentile
Weaknesses
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection'); CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-08-27T17:18Z
References (8)
https://github.com/AlexGladkov/claude-in-mobile/ · [email protected]https://github.com/AlexGladkov/claude-in-mobile/commit/a86d9e55694c98a122943eeff859461d0b9aa6d6 · [email protected]https://github.com/AlexGladkov/claude-in-mobile/issues/40 · [email protected]https://github.com/AlexGladkov/claude-in-mobile/releases/tag/v3.10.3 · [email protected]https://vuldb.com/cve/CVE-2026-81562 · [email protected]https://vuldb.com/submit/887253 · [email protected]https://vuldb.com/vuln/396058 · [email protected]https://vuldb.com/vuln/396058/cti · [email protected]
EPSS history
Timeline
  • 27 AUG 11:30Z
    AlexGladkov claude-in-mobile client.ts execSync os command injection
    cvelistv5