CVE-2025-59834

ADB MCP Server is a MCP (Model Context Protocol) server for interacting with Android devices through ADB. In versions 0.1.0 and prior, the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. This issue has been patched via commit 041729c.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/srmorete/adb-mcp/blob/master/src/index.ts#L334-L355	Product
https://github.com/srmorete/adb-mcp/commit/041729c0b25432df3199ff71b3163a307cf4c28c	Patch
https://github.com/srmorete/adb-mcp/security/advisories/GHSA-54j7-grvr-9xwg	Exploit Vendor Advisory
https://github.com/srmorete/adb-mcp/security/advisories/GHSA-54j7-grvr-9xwg	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:srmorete:adb_mcp_server:*:*:*:*:*:node.js:*:*

History

30 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) El Servidor ADB MCP es un servidor MCP (Protocolo de Contexto de Modelo) para interactuar con dispositivos Android a través de ADB. En las versiones 0.1.0 y anteriores, el Servidor MCP está escrito de una manera que es vulnerable a ataques de vulnerabilidad de inyección de comandos como parte de algunas de sus definiciones e implementaciones de herramientas del Servidor MCP. Este problema ha sido parcheado mediante el commit 041729c.

Information

Published : 2025-09-25 14:15

Updated : 2026-10-11 20:10

NVD link : CVE-2025-59834

Mitre link : CVE-2025-59834

CVE.ORG link : CVE-2025-59834

JSON object : View

Products Affected

srmorete

adb_mcp_server

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2025-59834", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59834", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-09-25T14:36:09.518535Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "srmorete", "product": "adb-mcp", "versions": [{"status": "affected", "version": "<= 0.1.0"}]}]}], "published": "2025-09-25T14:15:46.357", "references": [{"url": "https://github.com/srmorete/adb-mcp/blob/master/src/index.ts#L334-L355", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/srmorete/adb-mcp/commit/041729c0b25432df3199ff71b3163a307cf4c28c", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/srmorete/adb-mcp/security/advisories/GHSA-54j7-grvr-9xwg", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/srmorete/adb-mcp/security/advisories/GHSA-54j7-grvr-9xwg", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-77"}, {"lang": "en", "value": "CWE-78"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "ADB MCP Server is a MCP (Model Context Protocol) server for interacting with Android devices through ADB. In versions 0.1.0 and prior, the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. This issue has been patched via commit 041729c."}, {"lang": "es", "value": "El Servidor ADB MCP es un servidor MCP (Protocolo de Contexto de Modelo) para interactuar con dispositivos Android a trav\u00e9s de ADB. En las versiones 0.1.0 y anteriores, el Servidor MCP est\u00e1 escrito de una manera que es vulnerable a ataques de vulnerabilidad de inyecci\u00f3n de comandos como parte de algunas de sus definiciones e implementaciones de herramientas del Servidor MCP. Este problema ha sido parcheado mediante el commit 041729c."}], "lastModified": "2026-10-11T20:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:srmorete:adb_mcp_server:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "8BC0C798-F78B-4684-BC7E-8DCD4485EF86", "versionEndIncluding": "0.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}