Vulnerability · Published Aug 17, 2026 · Assigned by VulDB

CVE-2026-19978jiantao88 android-mcp-server Command Execution index.js child_process.exec os command injection

Medium 5.3

In plain English

A medium-severity OS command injection in android-mcp-server from jiantao88. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)1.2%top 31.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw has been found in jiantao88 android-mcp-server up to cfb872b2446794193b58edd63f4dbf6af48a6292. The impacted element is the function child_process.exec of the file build/index.js of the component Command Execution. Executing a manipulation of the argument deviceId/packageName/permission/extras[].key/extras[].value can lead to os command injection. It is possible to launch the attack on the local host. The exploit has been published and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. This patch is called 14e2bf27c88ba137e35cbb0c2a75f72b595bb98a. It is advisable to implement a patch to correct this issue.

Affected products (as reported)

Vendor	Product	Versions
jiantao88	android-mcp-server	cfb872b2446794193b58edd63f4dbf6af48a6292

Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References

VDB-391157 | jiantao88 android-mcp-server Command Execution index.js child_process.exec os command injection vdb-entry, technical-description
VDB-391157 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-19978 | CVE Analysis and Report third-party-advisory
Submit #873898 | jiantao88 android-mcp-server Latest remote code execute third-party-advisory
https://github.com/jiantao88/android-mcp-server/issues/1 exploit, issue-tracking
https://github.com/jiantao88/android-mcp-server/commit/14e2bf27c88ba137e35cbb0c2a75f72b595bb98a patch
https://github.com/jiantao88/android-mcp-server/ product