CVE-2026-117559 DroidMind through 0.4.0 Command Injection via Shell Allowlist Bypass

High 8.5 Published 27 Oct 2026 Updated 27 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-117559?

CVE-2026-117559 is a high-severity vulnerability in hyperb1iss droidmind, published on 27 Oct 2026.

Official description

DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command allowlist by using $(...) or backtick substitution. Attackers, including prompt-injected agents, can inject commands through parameters interpolated into Device.run_shell() or unvalidated Device.list_directory() to run blocked commands such as reboot on connected Android devices.

Weakness: CWE-78

Which versions are affected by CVE-2026-117559?

How do I fix CVE-2026-117559?

No fix has been published for CVE-2026-117559 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-117559 being exploited?

There is no known exploitation of CVE-2026-117559 in the wild and no public exploit code.

Sources

Also known as GHSA-533h-cccj-x6hp.