CVE-2026-117559: DroidMind through 0.4.0 Command Injection via Shell Allowlist Bypass
DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command allowlist by using $(...) or backtick substitution. Attackers, including prompt-injected agents, can inject commands through parameters interpolated into Device.runshell() or unvalidated Device.listdirectory() to run blocked commands such as reboot on connected Android devices.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using DroidMind through version 0.4.0 are exposed when MCP clients can supply parameters that reach Device.run_shell() or unvalidated Device.list_directory(). Connected Android devices are the targets of the resulting commands.
What does an attacker need to exploit this issue?
An attacker needs the ability to influence command parameters passed by an MCP client, including through a prompt-injected agent. They can use $(...) or backtick command substitution to bypass the shell command allowlist and execute otherwise blocked commands.
Are allowlisted commands sufficient protection?
No. The vulnerability specifically bypasses the shell command allowlist through command substitution, allowing blocked commands such as reboot to be injected.
How can I assess whether my use is affected?
Review whether your DroidMind deployment is version 0.4.0 or earlier and whether MCP-controlled input is interpolated into Device.run_shell() or passed to an unvalidated Device.list_directory(). Check for parameters containing $(...) or backticks, as these are the bypass mechanisms described.