Command Injection Vulnerability in Microsoft UFO Automation Framework
CVE-2026-105788
8.8HIGH
What is CVE-2026-105788?
The Microsoft UFO framework, specifically in versions prior to 3.0.10, contains a command injection vulnerability within its mobile interface. The issue arises from the inadequate validation of the 'type_text' and 'launch_app' parameters in the mobile_mcp_server.py file. When these parameters are passed into the ADB (Android Debug Bridge) shell command, it allows attackers to inject shell metacharacters, potentially executing unauthorized commands on connected devices. This vulnerability requires an authenticated Mobile MCP API key and a device authorized for ADB access, but it does not escalate privileges beyond those of the Android shell user. Users are urged to upgrade to version 3.0.10 to mitigate this risk.
Affected Version(s)
UFO < 3.0.10