CVE-2026-81562: AlexGladkov claude-in-mobile client.ts execSync os command injection
A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.10.3 is able to mitigate this issue. The patch is named a86d9e55694c98a122943eeff859461d0b9aa6d6. It is suggested to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AlexGladkov claude-in-mobileto a version that resolves this vulnerability.Fixed in 3.10.3Patch a86d9e55694c98a122943eeff859461d0b9aa6d6 - Configuration
Upgrade to AlexGladkov claude-in-mobile v3.10.3 to mitigate OS command injection in execSync in src/adb/client.ts.
AlexGladkov claude-in-mobile (src/adb/client.ts) execSync usage = mitigate via upgrade to 3.10.3
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Exposure is limited to installations of AlexGladkov claude-in-mobile 3.10.2 where an attacker already has local access and at least low-level privileges. The CVSS vector does not indicate a network-based or user-interaction-dependent attack path.
What does an attacker need to exploit the flaw?
An attacker needs local access, low privileges, and the ability to manipulate input reaching the execSync use in src/adb/client.ts. Public exploit information has been released, which may lower the effort required once those prerequisites are met.
What is the recommended remediation?
Upgrade AlexGladkov claude-in-mobile from version 3.10.2 to version 3.10.3. The referenced fix is patch a86d9e55694c98a122943eeff859461d0b9aa6d6.