Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw has been found in jiantao88 android-mcp-server up to cfb872b2446794193b58edd63f4dbf6af48a6292. The impacted element is the function child_process.exec of the file build/index.js of the component Command Execution. Executing a manipulation of the argument deviceId/packageName/permission/extras[].key/extras[].value can lead to os command injection. It is possible to launch the attack on the local host. The exploit has been published and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. This patch is called 14e2bf27c88ba137e35cbb0c2a75f72b595bb98a. It is advisable to implement a patch to correct this issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-19978 A flaw has been found in jiantao88 android-mcp-server up to cfb872b2446794193b58edd63f4dbf6af48a6292. The impacted element is the function child_process.exec of the f… https://www.cve.org/CVERecord?id=CVE-2026-19978
Post summary
A flaw was discovered in jiantao88's android-mcp-server, affecting the child_process.exec function, with the CVE referenced in the official record.
🚨*CVE* CVE-2026-19978 A flaw has been found in jiantao88 android-mcp-server up to cfb872b2446794193b58edd63f4dbf6af48a6292. The impacted element is the function child_process.exec of the f… https://www.cve.org/CVERecord?id=CVE-2026-19978 ----- Traducción: CVE-2026-19978 Se … https://infoflow.cloud`
Post summary
A new CVE-2026-19978 vulnerability in jiantao88 android-mcp-server’s child_process.exec function has been disclosed, with no PoC, exploit, active exploitation, or patch information provided.
CVE-2026-19978 OS Command Injection in jiantao88 android-mcp-server via child_process.exec https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-19978
Post summary
OS Command Injection (CVE-2026-19978) in jiantao88 android-mcp-server via child_process.exec is disclosed, but no PoC, exploit, or patch is provided.