Tools AI Risk Radar ai-incident-0266
Incident record
DroidMind tools can pass unvalidated commands to Android
- Severity
- High
- Status
- Proof-of-concept
- Type
- Infra Vuln
- Target
- DroidMind MCP server through 0.4.0
- Actor
- Researcher disclosure
- CVE
- CVE-2026-117559
What happened
Researcher examples show tool arguments reaching shell commands on a connected Android device. The risk applies to the affected third-party device-control server.
The original issue was opened on 26 October and the CVE published on 27 October. The CNA lists versions through 0.4.0 and rates it High. The issue remained open at review, with demonstration inputs and no verified fixed release. The examples establish a reported weakness rather than a confirmed customer compromise.
Sources
- Canonical CVE recordraw.githubusercontent.com/CVEProject/cvelistV5/main/cves/202…
- Original researcher issuegithub.com/hyperb1iss/droidmind/issues/17
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 28 October 2026