RCE in Jiantao88 Android-Mcp-Server
CVE-2026-19978
A flaw has been found in jiantao88 android-mcp-server up to cfb872b2446794193b58edd63f4dbf6af48a6292. The impacted element is the function child_process.exec of the file build/index.js of the component Command Execution. Executing a manipulation of the argument deviceId/packageName/permission/extras[].key/extras[].value can lead to os command injection. It is possible to launch the attack on the local host. The exploit has been published and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. This patch is called 14e2bf27c88ba137e35cbb0c2a75f72b595bb98a. It is advisable to implement a patch to correct this issue.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
EPSS exploit prediction
EPSS: 0.012 (67.0th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 67th percentile — 67.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.012 · change: +0.005
Affected products
- Jiantao88 Android-Mcp-Server — versions cfb872b2446794193b58edd63f4dbf6af48a6292
Weakness classification (CWE)
References
- vuldb.com/vuln/391157 (technical-description, vdb-entry)
- vuldb.com/vuln/391157/cti (signature, permissions-required)
- vuldb.com/cve/CVE-2026-19978 (third-party-advisory)
- vuldb.com/submit/873898 (third-party-advisory)
- github.com/jiantao88/android-mcp-server/issues/1 (issue-tracking, exploit)
- github.com/jiantao88/android-mcp-server/commit/14e2bf27c88ba137e35cbb0c2a75f72b… (patch)
- github.com/jiantao88/android-mcp-server/ (product)
Frequently asked questions
- What is CVE-2026-19978?
- CVE-2026-19978 is a medium-severity vulnerability in Jiantao88 Android-Mcp-Server, classified under Command Injection. CVSS score: 5.3/10. Published 2026-08-17.
- How severe is CVE-2026-19978?
- Medium severity. CVSS v3 base score is 5.3 out of 10.