PT-2026-4843 · Mobsf · Mobsf

Smaranchand · Published 2026-01-26 · Updated 2026-02-14 · CVE-2026-24490

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions MobSF versions prior to 4.4.5

Description MobSF is a mobile application security testing tool. A Stored Cross-site Scripting (XSS) vulnerability exists in MobSF’s Android manifest analysis. This allows an attacker to execute arbitrary JavaScript in a victim’s browser session by uploading a malicious APK. Specifically, the android:host attribute from <data android:scheme="android secret code"> elements is rendered in HTML reports without proper sanitization, potentially leading to session hijacking and account takeover. The vulnerability is triggered when MobSF analyzes an Android APK containing a <data> element with android:scheme="android secret code", extracting the android:host attribute and inserting it directly into the analysis report without HTML escaping. The vulnerable code path involves data extraction from the manifest file, template string formatting, and unsafe rendering of the extracted data in the HTML report. A proof-of-concept (PoC) APK has been created to demonstrate the vulnerability.

Recommendations Update MobSF to version 4.4.5 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-24490

GHSA-8HF7-H89P-3PQJ

Affected Products

Mobsf

References · 14

• 🔥 https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-8hf7-h89p-3pqj · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24490.json · Exploit
• https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/2b08dd050e7685ee2a14fdbb454affab94129eae · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-24490 · Security Note
• https://osv.dev/vulnerability/GHSA-8hf7-h89p-3pqj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24490 · Vendor Advisory
• https://github.com/MobSF/Mobile-Security-Framework-MobSF · Note
• https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.4.5 · Note
• https://twitter.com/_cvereports/status/2015985775511236957 · Twitter Post
• https://twitter.com/TheHackerWire/status/2015960756010008745 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2016007926591193119 · Twitter Post
• https://twitter.com/CVEnew/status/2015988785817760197 · Twitter Post
• https://t.me/CVEtracker/43036 · Telegram Post
• https://twitter.com/HackingTeam777/status/2022701263557702017 · Twitter Post