ADB MCP Server is a MCP (Model Context Protocol) server for interacting with Android devices through ADB. In versions 0.1.0 and prior, the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. This issue has been patched via commit 041729c.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/srmorete/adb-mcp/commit/041729c0b25432df3199ff71b3163a307cf4c28c Patch
- https://github.com/srmorete/adb-mcp/security/advisories/GHSA-54j7-grvr-9xwg Exploit, Vendor Advisory
- https://github.com/srmorete/adb-mcp/security/advisories/GHSA-54j7-grvr-9xwg Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 9.8 · srmoreteNVD modified 2026-10-11 20:10
Affected (CPE criteria) 1
cpe:2.3:a:srmorete:adb_mcp_server:*:*:*:*:*:node.js:*:*
References 4
- https://github.com/srmorete/adb-mcp/blob/master/src/index.ts#L334-L355 Product
- https://github.com/srmorete/adb-mcp/commit/041729c0b25432df3199ff71b3163a307cf4c28c Patch
- https://github.com/srmorete/adb-mcp/security/advisories/GHSA-54j7-grvr-9xwg Exploit, Vendor Advisory
- https://github.com/srmorete/adb-mcp/security/advisories/GHSA-54j7-grvr-9xwg Exploit, Vendor Advisory