CVE-2026-19978

CVE-2026-19978 is a command injection vulnerability in the android-mcp-server project where the adb wrapper uses Node.js `child_process.exec()` with string interpolation on the `deviceId`, `packageName`, and `extras` parameters. The fix switches to `spawn()` with argument arrays — a 30-second refactor that separates command from arguments. The mechanical simplicity of this fix is the vulnerability's most important lesson: there was no deep architectural reason the developer chose shell injection; `exec()` was simply the frictionless default, and the path of least resistance led directly to remote code execution. The real systemic failure is that MCP server architecture creates a false trust boundary. Developers naturally treat incoming tool calls from MCP clients as authorized requests, but AI agents consuming these tools can be manipulated through prompt injection or adversarial context contamination. The MCP server has no visibility into whether a command originated from a legitimate user or a poisoned context — and critically, neither does the developer integrating the server. If you're defending against this: switch to `spawn()` with argument arrays immediately, not because the vulnerability is complex, but because the trap was obvious and the fix trivial. Audit any other `exec()` or `execSync()` calls in the same codebase for the same pattern. Beyond the immediate fix, treat your MCP server as an untrusted input surface — validate and sanitize every parameter as if it came from a prompt injection attack, because in an AI agent context, it effectively does. The blast radius here is worse than the CVSS 5.3 suggests. Android MCP servers run on developer workstations with USB-connected devices — a compromised AI agent pivots from a poisoned context window to executing arbitrary shell commands on both the development machine and the attached Android device. That's not server-side RCE with a patch cycle; that's supply chain contamination of development infrastructure, bypassing corporate endpoint controls that explicitly exclude developer tools. The CVSS framework has no vocabulary for 'compromised AI agent as pivot point,' and the 'rolling release' versioning means there's no version gate to target — the fix exists as a commit but lacks any mechanism to propagate the remediation to downstream consumers.

Reviewed through automated stages and approved by a human before publication.