PT-2026-4843 · Mobsf · Mobsf

Smaranchand · Publicado 2026-01-26 · Atualizado 2026-02-14 · CVE-2026-24490

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions MobSF versions prior to 4.4.5

Description MobSF is a mobile application security testing tool. A Stored Cross-site Scripting (XSS) vulnerability exists in MobSF’s Android manifest analysis. This allows an attacker to execute arbitrary JavaScript in a victim’s browser session by uploading a malicious APK. Specifically, the android:host attribute from <data android:scheme="android secret code"> elements is rendered in HTML reports without proper sanitization, potentially leading to session hijacking and account takeover. The vulnerability is triggered when MobSF analyzes an Android APK containing a <data> element with android:scheme="android secret code", extracting the android:host attribute and inserting it directly into the analysis report without HTML escaping. The vulnerable code path involves data extraction from the manifest file, template string formatting, and unsafe rendering of the extracted data in the HTML report. A proof-of-concept (PoC) APK has been created to demonstrate the vulnerability.

Recommendations Update MobSF to version 4.4.5 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-24490

GHSA-8HF7-H89P-3PQJ

Produtos afetados

Mobsf

Referências · 14

• 🔥 https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-8hf7-h89p-3pqj · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24490.json · Exploit
• https://github.com/MobSF/Mobile-Security-Framework-MobSF · Nota
• https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/2b08dd050e7685ee2a14fdbb454affab94129eae · Correção
• https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.4.5 · Nota
• https://twitter.com/_cvereports/status/2015985775511236957 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-24490 · Nota de Segurança
• https://twitter.com/TheHackerWire/status/2015960756010008745 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-8hf7-h89p-3pqj · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2016007926591193119 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-24490 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2015988785817760197 · Publicação no Twitter
• https://t.me/CVEtracker/43036 · Publicação no Telegram
• https://twitter.com/HackingTeam777/status/2022701263557702017 · Publicação no Twitter