Cpe:2.3:a:droidmind:droidmind:*:*:*:*:*:*:*:*

DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command allowlist by using $(...) or backtick substitution.