Skip to main content

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CVE-2025-59834

High
9.8/10

Summary

The MCP Server at 'https://github.com/srmorete/adb-mcp' is written in a way that is vulnerable to Command Injection vulnerability attacks as part of some of its MCP Server tool definition and implementation in versions through 0.1.0. The MCP Server is also published publicly to npm at 'www.npmjs.com/package/adb-mcp' and allows users to install it.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-77 - Command Injection

A command injection attack involves injecting an operating system command through the data input, which gets executed on the host operating system with the privileges of the victimized application. The impact of a command injection attack may range from loss of data confidentiality and integrity to unauthorized remote access to the hosting system. The attack may cause serious data breaches and system takeover.

References

Advisory Timeline

  • Published