GHSA-5qhv-x9j4-c3vm
High · 8.3CVSS
8.3
EPSS
—
Published
Apr 4, 2026
CISA due date
—
The record
@mobilenext/mobile-mcp: Arbitrary Android Intent Execution via mobile_open_url
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @mobilenext/mobile-mcp | 0 | 0.0.50 |
Related vulnerabilities
- CVE-2026-35394 Mobile Next is an MCP server for mobile development and automation. Same vulnerability
- CVE-2026-33989 Mobile Next is an MCP server for mobile development and automation. Also affects @mobilenext/mobile-mcp
- GHSA-3p2m-h2v6-g9mx @mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen… Also affects @mobilenext/mobile-mcp
- CVE-2026-73335 Android application "Myna Point" is vulnerable to Improper Authorization in Handler for… CWE-939
- CVE-2026-21075 Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3… CWE-939
- CVE-2026-21062 Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local… CWE-939
- CVE-2026-59717 Home Assistant is open source home automation software focused on local control and… CWE-939
- CVE-2026-12189 A flaw has been found in Moovit Bus & Public Transit App 1.18 on Android. CWE-939