cve.bz

CVE-2026-35394

8.8 highEPSS 0.4%

High (8.8) in mobilenexthq mobile mcp. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in @mobilenext/mobile-mcp 0.0.50.

Mobile Next is an MCP server for mobile development and automation. Prior to 0.0.50, the mobile_open_url tool in mobile-mcp passes user-supplied URLs directly to Android's intent system without any scheme validation, allowing execution of arbitrary Android intents, including USSD codes, phone calls, SMS messages, and content provider access. This vulnerability is fixed in 0.0.50.

Severity

CVSS 3.1

8.8 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-31)
CWE
CWE-939
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-5qhv-x9j4-c3vmnpm@mobilenext/mobile-mcp<0.0.500.0.50

References

Check your stackJSON