RCE in Hyperb1iss Droidmind
CVE-2026-117559
DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command allowlist by using $(...) or backtick substitution. Attackers, including prompt-injected agents, can inject commands through parameters interpolated into Device.run_shell() or unvalidated Device.list_directory() to run blocked commands such as reboot on connected Android devices.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/hyperb1iss/droidmind/issues/17 (issue-tracking)
- github.com/hyperb1iss/droidmind (product)
- github.com/hyperb1iss/droidmind/blob/v0.4.0/droidmind/security.py (technical-description)
- www.vulncheck.com/advisories/droidmind-through-0.4.0-command-injection-via-shel… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-117559?
- CVE-2026-117559 is a high-severity vulnerability in Hyperb1iss Droidmind, classified under OS Command Injection. CVSS score: 7.8/10. Published 2026-10-27.
- How severe is CVE-2026-117559?
- High severity. CVSS v3 base score is 7.8 out of 10.