Finding an RCE in iOS-remote: OS Command Injection via Flask

How I found an OS command injection vulnerability in iOS-remote, a Flask-based iOS device management tool, and achieved remote code execution through an unsanitized subprocess call.

February 28, 2026 · 6 min