Microsoft UFO is an open-source framework for intelligent automation across devices and platforms.
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the type_text and launch_app tools in ufo/client/mcp/http_servers/mobile_mcp_server.py pass the authenticated caller-controlled text and package_name parameters into adb shell command argument positions without comprehensive validation. The adb client joins those arguments into a remote command string that the Android shell reparses, allowing shell metacharacters to execute additional commands on an authorized connected device as the Android shell user. Exploitation requires a va
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Microsoft, Google
- Product
- android
- CVSS
- 8.8
- Exposure class
- Mobile OS
Why it ranks 15 (Routine)
- CVSS 8.8 high
- Product class: mobile OS
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-105788 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.