CVE-2026-104585

9.8Critical

Published 13 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-77

Impact

Remote, unauthenticated attackers can execute arbitrary commands on the MobSF server by sending malicious requests to exposed endpoints. They only need network access to the web interface or API.

Root cause

Improper input sanitization allows command injection across /download_data/, /api/v1/scan, and the Dynamic Analyzer ADB integration module.

Affected systems

Mobile Security Framework (MobSF) version 4.5.2

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Fixed version not specified; restrict network access to MobSF endpoints or take the service offline until a patch is released.

shell

$ git pull origin master

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api/v1/scan, Dynamic Analyzer ADB integration module.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-104585