CVE-2026-105788 in UFO
Summary
by MITRE • 10/06/2026
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the type_text and launch_app tools in ufo/client/mcp/http_servers/mobile_mcp_server.py pass the authenticated caller-controlled text and package_name parameters into adb shell command argument positions without comprehensive validation. The adb client joins those arguments into a remote command string that the Android shell reparses, allowing shell metacharacters to execute additional commands on an authorized connected device as the Android shell user. Exploitation requires a valid Mobile MCP API key and a reachable device authorized for ADB, and it does not establish host operating-system execution, Android root execution, or access beyond the Android shell-user privileges. This issue is fixed in version 3.0.10.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified in Microsoft UFO prior to version 3.0.10 represents a significant command injection risk within its Mobile MCP server implementation. As an open-source framework designed for intelligent automation across diverse devices and platforms, the security integrity of its interaction with Android Debug Bridge (ADB) is critical. The core technical flaw resides specifically in the type_text and launch_app tools located within the mobile_mcp_server.py module. These functions accept parameters such as text input and package names directly from authenticated callers via HTTP requests. Instead of implementing strict validation or sanitization routines, these frameworks pass user-supplied data directly into argument positions for ADB shell commands. This architectural decision creates a direct pathway for attackers to inject malicious payloads if they can control the input values sent to these endpoints.
The operational mechanism of this exploitation relies on how the Android shell processes command strings. When the adb client receives the arguments, it joins them into a single remote command string which is then executed by the Android shell environment. The Android shell performs its own parsing and interpretation of special characters before executing commands. Consequently, if an attacker includes shell metacharacters such as semicolons, pipes, or ampersands within the text or package name parameters, these characters are interpreted by the shell rather than treated as literal data. This allows for command chaining, enabling the execution of arbitrary system commands on the connected Android device alongside the intended operation. For instance, an attacker could append a secondary command to exfiltrate local files or modify application settings without triggering any immediate error that would alert the user or administrator.
The impact of this vulnerability is constrained by several factors but remains severe for targeted attacks involving authorized devices. Exploitation requires two primary conditions: first, the attacker must possess a valid Mobile MCP API key to authenticate against the service, and second, there must be an Android device connected that has been explicitly authorized for ADB access from the host machine running the UFO framework. It is crucial to note that this vulnerability does not escalate privileges beyond the permissions of the Android shell user on the target device. This means it cannot achieve root access or compromise the underlying host operating system where Microsoft UFO is installed. However, within the context of mobile automation and testing environments, having arbitrary command execution as the shell user can lead to significant data leakage, unauthorized modification of app states, or disruption of automated workflows that rely on these specific tools.
To mitigate this risk, organizations utilizing versions prior to 3.0.10 must upgrade immediately to version 3.0.10 where the issue has been resolved through improved input validation and sanitization practices. In environments where upgrading is not immediately feasible, strict network segmentation should be applied to ensure that only trusted internal systems can access the Mobile MCP API endpoints. Additionally, implementing robust authentication controls such as multi-factor authentication for API keys reduces the likelihood of unauthorized actors obtaining valid credentials. From a defensive posture perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command and is indicative of ATT&CK technique T1059 Command and Scripting Interpreter usage within mobile environments. Regular auditing of input handling logic in automation frameworks is essential to prevent similar injection vectors from being exploited in future iterations or related tools.