{"cve":"CVE-2025-59834","nvd":{"published":"2025-09-25T14:15:46.357","modified":"2026-10-11T20:10:00.200","status":"Analyzed","description":"ADB MCP Server is a MCP (Model Context Protocol) server for interacting with Android devices through ADB. In versions 0.1.0 and prior, the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. This issue has been patched via commit 041729c.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-77","CWE-78"],"references":["https://github.com/srmorete/adb-mcp/blob/master/src/index.ts#L334-L355","https://github.com/srmorete/adb-mcp/commit/041729c0b25432df3199ff71b3163a307cf4c28c","https://github.com/srmorete/adb-mcp/security/advisories/GHSA-54j7-grvr-9xwg","https://github.com/srmorete/adb-mcp/security/advisories/GHSA-54j7-grvr-9xwg"],"products":["srmorete:adb_mcp_server"],"source":"nvd","synced_at":"2026-10-19T22:10:08.713834912+00:00"},"epss":{"cve":"CVE-2025-59834","score":0.02514,"percentile":0.84684,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-54j7-grvr-9xwg","url":"https://osv.dev/vulnerability/GHSA-54j7-grvr-9xwg","summary":"Command Injection in adb-mcp MCP Server","modified":"2026-09-10T03:50:27.950735968Z","packages":[{"ecosystem":"npm","name":"adb-mcp","purl":"pkg:npm/adb-mcp","ranges":["<=0.1.0"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}