CVE-2026-81562 in claude-in-mobile
Summary
by MITRE • 08/27/2026
A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.10.3 is able to mitigate this issue. The patch is named a86d9e55694c98a122943eeff859461d0b9aa6d6. It is suggested to upgrade the affected component.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
A critical security vulnerability has been identified in version 3.10.2 of the claude-in-mobile project developed by AlexGladkov, specifically within the execSync function located in the src/adb/client.ts file. This flaw constitutes a classic operating system command injection weakness, categorized under CWE-78 in the Common Weakness Enumeration standard. The vulnerability arises because the application fails to properly sanitize or validate user-supplied input before passing it as an argument to underlying shell commands via Node.js execSync. When an attacker provides specially crafted input that includes shell metacharacters such as semicolons, pipes, or backticks, these characters are interpreted by the operating system's command interpreter rather than being treated as literal data. This allows for the execution of arbitrary OS-level commands with the privileges granted to the application process.
The operational impact of this vulnerability is severe due to its potential for remote code execution within the context of the mobile environment where the application operates. Although the attack vector requires a local approach, meaning the attacker must have some level of access or interaction capability on the device hosting the vulnerable software, the consequences can still be significant depending on the security posture of the host system. An adversary could potentially exfiltrate sensitive data stored in the application's directory, modify configuration files, install malicious payloads, or use the compromised instance as a pivot point for further network attacks if the mobile device is connected to broader networks. The fact that an exploit has been released publicly increases the risk landscape considerably, as it lowers the barrier to entry for less sophisticated attackers who may leverage existing proof-of-concept code rather than developing their own exploitation techniques from scratch.
This type of vulnerability aligns with several tactics in the MITRE ATT&CK framework, particularly those related to Command and Scripting Interpreter abuse and Execution via local processes. The failure to implement proper input validation represents a fundamental flaw in secure coding practices, highlighting the importance of using safer alternatives like execFile or spawn which do not invoke a shell by default when possible, thereby reducing the attack surface associated with command interpretation. If shell invocation is strictly necessary, developers must rigorously escape all special characters within user inputs to ensure they are treated as data rather than executable code.
To mitigate this vulnerability and restore security integrity, it is imperative that users and administrators upgrade immediately to version 3.10.3 of the claude-in-mobile software. The developer has addressed this issue in patch a86d9e55694c98a122943eeff859461d0b9aa6d6, which implements the necessary input sanitization and validation mechanisms to prevent command injection attacks. Organizations relying on this tool should verify their current version through standard package management tools or repository checks and apply the update as soon as possible. Additionally, implementing runtime application self-protection measures or strict file integrity monitoring can provide an additional layer of defense against potential exploitation attempts while ensuring that any future updates are promptly applied to maintain a robust security posture against evolving threats.