mobile-next/mobile-mcp

mobile-next/mobile-mcp

Releases49

Frequency1 week 1 day

Last Release 3 days ago

Stars5.12K

Model Context Protocol Server for Mobile Automation and Scraping (iOS, Android, Emulators, Simulators and Real Devices)

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2026-35394 ↗	Apr 6, 2026Monday, 6 April 2026, 21:16	8.3 HIGH	—
Mobile Next is an MCP server for mobile development and automation. Prior to 0.0.50, the mobile_open_url tool in mobile-mcp passes user-supplied URLs directly to Android's intent system without any scheme validation, allowing execution of arbitrary Android intents, including USSD codes, phone calls, SMS messages, and content provider access. This vulnerability is fixed in 0.0.50.
CVE-2026-33989 ↗	Mar 27, 2026Friday, 27 March 2026, 22:16	8.1 HIGH	—
Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the `@mobilenext/mobile-mcp` server contains a Path Traversal vulnerability in the `mobile_save_screenshot` and `mobile_start_screen_recording` tools. The `saveTo` and `output` parameters were passed directly to filesystem operations without validation, allowing an attacker to write files outside the intended workspace. Version 0.0.49 fixes the issue.