AIKIDO-2026-616489

TL;DR

appium-adb constructs adb shell command lines such as am start -n <pkg>/<activity> from caller-supplied application package and activity names in startApp, buildStartCmd, and waitForActivityOrNot. Before the fix only the $ character was escaped, so names containing shell metacharacters such as ;, |, backticks, &&, or $(...) are passed unescaped into the command executed via adb shell. An application that forwards untrusted package or activity names lets an attacker break out of the intended component argument and run arbitrary commands on the connected device. The fix adds an assertSafeComponentName allowlist (SAFE_COMPONENT_NAME_PATTERN) that rejects illegal characters and escapes the remaining $ and * when building the component argument.