CVE-2020-7636

The adb-driver package versions prior to and including 0.1.8 contain a command injection vulnerability in the command function. The issue arises because user-controlled input is passed directly to a command execution interface without any sanitization [1][2].

Exploitation requires an attacker to control the command argument passed to the execADBCommand function. No authentication is needed; the attacker only needs to invoke the vulnerable API. A proof-of-concept demonstrates injection of arbitrary commands by appending a concatenation operator and a command string [2].

Successful exploitation allows an attacker to execute arbitrary operating system commands with the privileges of the application using the adb-driver package. This can lead to full compromise of the host system or device.

As of the publication of this CVE, there is no fixed version available for adb-driver. Users are advised to avoid using the package or to implement their own input validation and sanitization as a workaround [2].