Command Injection Vulnerability in DroidMind by Hyperb1iss
CVE-2026-117559

8.5HIGH

Key Information:

Vendor

Hyperb1iss

Status
Droidmind
Vendor
CVE Published:
27 October 2026

What is CVE-2026-117559?

The vulnerability in DroidMind versions up to 0.4.0 allows attackers to exploit a command injection flaw, enabling the bypass of shell command allowlist restrictions. By utilizing command substitutions like $(...) or backtick substitution, malicious actors can inject harmful commands into parameters passed to Device.run_shell() or unvalidated Device.list_directory(). This can lead to unauthorized execution of commands like rebooting connected Android devices, posing a significant risk to users.

Affected Version(s)

droidmind 0 <= 0.4.0

References

https://github.com/hyperb1iss/droidmind/issues/17
issue-tracking
https://github.com/hyperb1iss/droidmind
product
https://github.com/hyperb1iss/droidmind/blob/v0.4.0/droid...
technical-description

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.