CVE-2026-105788— Microsoft UFO: Authenticated Android shell command injection in Mobile MCP type_text and launch_app
Quick assessment
Affected
microsoft UFO
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Microsoft UFO 是一个跨设备和平台的智能自动化开源框架。在 3.0.10 版本之前，ufo/client/mcp/http_servers/mobile_mcp_server.py 中的 type_text 和 launch_app 工具会将经过身份验证的攻击者可控的 text 和 package_name 参数，未经充分验证直接传入 adb shell 命令的参数位置。ADB 客户端将这些参数拼接成一个远程命令字符串，Android shell 会对其重新解析，从而导致 shell 元字符可以在已授权
Possible ATT&CK Techniques 2 AI
T1053 · Scheduled Task/Job T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-105788
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Microsoft UFO: Authenticated Android shell command injection in Mobile MCP type_text and launch_app
Source: CVE Program / CVE List V5
Vulnerability Description
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the type_text and launch_app tools in ufo/client/mcp/http_servers/mobile_mcp_server.py pass the authenticated caller-controlled text and package_name parameters into adb shell command argument positions without comprehensive validation. The adb client joins those arguments into a remote command string that the Android shell reparses, allowing shell metacharacters to execute additional commands on an authorized connected device as the Android shell user. Exploitation requires a valid Mobile MCP API key and a reachable device authorized for ADB, and it does not establish host operating-system execution, Android root execution, or access beyond the Android shell-user privileges. This issue is fixed in version 3.0.10.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-105788
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-105788
请登录查看更多情报信息。
Other References for CVE-2026-105788 (4)
-
https://github.com/microsoft/UFO/releases/tag/v3.0.10 x_refsource_MISC
-
https://github.com/microsoft/UFO/security/advisories/GHSA-6ppj-5886-4f26 x_refsource_CONFIRM
Same Patch Batch · microsoft · 2026-10-06 · 11 CVEs total
| CVE-2026-105794 | 9.1 CRITICAL | MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL |
| CVE-2026-105793 | 9.1 CRITICAL | Microsoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key` |
| CVE-2026-105797 | 8.8 HIGH | SimpleChat: Command injection via authorization-gate ordering flaw (arbitrary process spaw |
| CVE-2026-105796 | 8.8 HIGH | Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP gene |
| CVE-2026-105798 | 8.7 HIGH | SimpleChat: Stored XSS via group document filename in inline onclick handler |
| CVE-2026-105791 | 7.5 HIGH | Microsoft UFO: Arbitrary code execution in `run_shell` via `explorer.exe` argument injecti |
| CVE-2026-105792 | 6.5 MEDIUM | Microsoft UFO: Authenticated task-result request can deadlock UFO server session manager |
| CVE-2026-105790 | 6.4 MEDIUM | Microsoft UFO: Authenticated Galaxy device registration can bypass WebSocket SSRF IP pinni |
| CVE-2026-105789 | 5.4 MEDIUM | Microsoft UFO: Arbitrary file write in the Linux MCP `execute_command` tool |
| CVE-2026-105795 | 3.1 LOW | Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests |
IV. Related Vulnerabilities
Same product: UFO
-
CVE-2026-105793
Microsoft UFO: Authenticated Android shell command injection -
CVE-2026-105792
Microsoft UFO: Authenticated task-result request can deadloc -
CVE-2026-105791
Microsoft UFO: Arbitrary code execution in `run_shell` via ` -
CVE-2026-105790
Microsoft UFO: Authenticated Galaxy device registration can -
CVE-2026-105789
Microsoft UFO: Arbitrary file write in the Linux MCP `execut
Same vendor: microsoft
-
CVE-2026-105798
SimpleChat: Stored XSS via group document filename in inline -
CVE-2026-105797
SimpleChat: Command injection via authorization-gate orderin -
CVE-2026-105796
Kiota: Code injection through doc-comment delimiter reformat -
CVE-2026-105795
Kiota: Unsafe oauth_card_path references in Kiota-generated -
CVE-2026-105794
MsQuic: Improper Certificate Validation in Microsoft.Native.
Same weakness: CWE-78
-
CVE-2026-105797
SimpleChat: Command injection via authorization-gate orderin -
CVE-2026-105793
Microsoft UFO: Authenticated Android shell command injection -
CVE-2026-85523
OS Command Injection in Felisify Informatics' SambaBox -
CVE-2026-91140
OS command injection in Progress Software Autonomous REST Co -
CVE-2026-105841
lrzsz before 0.13.0 OS Command Injection via lrz Pipe Mode
V. Comments for CVE-2026-105788
No comments yet