{"id":"EUVD-2025-31042","enisaUuid":"08e64469-8be5-32c2-81f8-a2f335b444c8","description":"ADB MCP Server is a MCP (Model Context Protocol) server for interacting with Android devices through ADB. In versions 0.1.0 and prior, the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. This issue has been patched via commit 041729c.","datePublished":"Sep 25, 2025, 1:41:15 PM","dateUpdated":"Sep 25, 2025, 2:36:27 PM","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/srmorete/adb-mcp/security/advisories/GHSA-54j7-grvr-9xwg\nhttps://github.com/srmorete/adb-mcp/commit/041729c0b25432df3199ff71b3163a307cf4c28c\nhttps://github.com/srmorete/adb-mcp/blob/master/src/index.ts#L334-L355\n","aliases":"CVE-2025-59834\nGHSA-54j7-grvr-9xwg\n","assigner":"GitHub_M","epss":2.51,"enisaIdProduct":[{"id":"d2adf40d-1a8e-39d9-8820-bf9f40b202db","product":{"name":"adb-mcp","vendor":{"name":"srmorete"}},"product_version":"≤ 0.1.0"}],"enisaIdVendor":[{"id":"9678aa8e-42b4-3421-ab4b-dde7a155b5b3","vendor":{"name":"srmorete"}}],"enisaIdVulnerability":[{"id":"012602a4-c1bb-3704-a0ad-0dac0d20cdcb","vulnerability":{"id":"GHSA-54j7-grvr-9xwg","description":"Command Injection in adb-mcp MCP Server","datePublished":"Sep 24, 2025, 6:59:22 PM","dateUpdated":"Sep 26, 2025, 4:29:51 PM","baseScore":0.0,"references":"https://github.com/srmorete/adb-mcp/security/advisories/GHSA-54j7-grvr-9xwg\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-59834\nhttps://github.com/srmorete/adb-mcp/commit/041729c0b25432df3199ff71b3163a307cf4c28c\nhttps://github.com/srmorete/adb-mcp\nhttps://github.com/srmorete/adb-mcp/blob/master/src/index.ts#L334-L355\n","enisa_id":"EUVD-2025-31042\n","aliases":"CVE-2025-59834\nGHSA-54j7-grvr-9xwg\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:13:00 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"66630ebf-ef5b-3302-92be-a88d35eb0a94","vulnerability":{"id":"CVE-2025-59834","description":"ADB MCP Server is a MCP (Model Context Protocol) server for interacting with Android devices through ADB. In versions 0.1.0 and prior, the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. This issue has been patched via commit 041729c.","datePublished":"Sep 25, 2025, 1:41:15 PM","dateUpdated":"Sep 25, 2025, 2:36:27 PM","status":"PUBLISHED","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/srmorete/adb-mcp/security/advisories/GHSA-54j7-grvr-9xwg\nhttps://github.com/srmorete/adb-mcp/commit/041729c0b25432df3199ff71b3163a307cf4c28c\nhttps://github.com/srmorete/adb-mcp/blob/master/src/index.ts#L334-L355\n","enisa_id":"EUVD-2025-31042\n","assigner":"GitHub_M","epss":2.51,"dataProcessed":"Nov 2, 2026, 7:14:43 AM","vulnerabilityProduct":[{"id":"b036ff1d-e166-38d8-b5c0-b798f935b282","product":{"name":"adb-mcp","vendor":{"name":"srmorete"}},"product_version":"≤ 0.1.0"},{"id":"cc55e9e0-beb9-4276-8a7b-eb001580a125","product":{"name":"adb-mcp","vendor":{"name":"srmorete"}},"product_version":"≤ 0.1.0"}],"vulnerabilityVendor":[{"id":"76b9809d-6cae-3481-ada8-3ca775803673","vendor":{"name":"srmorete"}}]}}],"enisaIdAdvisory":[]}