mobile-next vulnerabilities

Products

• mobile-mcp 2

Latest mobile-next CVEs

Newest publication first

1. CVE-2026-35394 Mobile Next has Arbitrary Android Intent Execution via mobile_open_url

   Published 2026-04-06

   High·CVSS 8.8 EPSS 0.40%

   Mobile Next is an MCP server for mobile development and automation. Prior to 0.0.50, the mobile_open_url tool in mobile-mcp passes user-supplied URLs directly to Android's intent system without any scheme validation, allowing execution of arbitrary Android intents, including USSD...

2. CVE-2026-33989 @mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools

   Published 2026-03-27

   Medium·CVSS 6.5 EPSS 0.50%

   Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the @mobilenext/mobile-mcp server contains a Path Traversal vulnerability in the mobile_save_screenshot and mobile_start_screen_recording tools. The saveTo and output parameters were pass...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.