TI-2026-81163 CVE-2026-117559 · GHSA-533h-cccj-x6hp
Command injection in DroidMind lets MCP clients bypass shell allowlist
Priority MEDIUM 40
DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command allowlist by using $(...) or backtick substitution.