CVE-2026-35394
1 advisory.
npm/@mobilenext/mobile-mcp CVE-2026-35394: high 8.3
@mobilenext/mobile-mcp: Arbitrary Android Intent Execution via mobile_open_url
Action: Upgrade @mobilenext/mobile-mcp to 0.0.50 or later.
npm i @mobilenext/mobile-mcp@0.0.50Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.0.50 | - |
Fixed versions
| 0.0.50 |
Sources
- osv: GHSA-5qhv-x9j4-c3vm
- https://github.com/mobile-next/mobile-mcp/security/advisories/GHSA-5qhv-x9j4-c3vm
- https://nvd.nist.gov/vuln/detail/CVE-2026-35394
- https://github.com/mobile-next/mobile-mcp/pull/299
- https://github.com/mobile-next/mobile-mcp
- https://github.com/mobile-next/mobile-mcp/releases/tag/0.0.50
CVE-2026-35394 · published · modified · JSON