CVE-2025-59834
Critical
Description
ADB MCP Server is a MCP (Model Context Protocol) server for interacting with Android devices through ADB. In versions 0.1.0 and prior, the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. This issue has been patched via commit 041729c.
SeverityCritical
CVSS9.8
Exploit probability—
ProductSrmorete Adb Mcp Server
PublishedSep 25, 2025
First seenSep 25, 2025
Weakness typeCWE-77Command injectionCWE-78OS command injection
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| srmorete adb_mcp_server | v ≤ 0.1.0 | — |
| adb-mcpnpm | v ≤ 0.1.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.