Read the docs
TI-2026-25938 Aliases CVE-2026-33545GHSA-hqjr-43r5-9q58

MobSF has SQL Injection in its SQLite Database Viewer Utils

Priority MEDIUM 62CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

MobSF is a mobile application security testing tool used. Prior to version 4.4.6, MobSF's `read_sqlite()` function in `mobsf/MobSF/utils.py` (lines 542-566) uses Python string formatting (`%`) to construct SQL queries with table names read from a SQLite database's `sqlite_master` table. When a security analyst uses MobSF to analyze a malicious mobile application containing a crafted SQLite database, attacker-controlled table names are interpolated directly into SQL queries without parameterization or escaping. This allows an attacker to cause denial of service and achieve SQL injection. Version 4.4.6 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00286 21st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Mobile-Security-Framework-MobSF (MobSF): 4.4.6mobsf (PyPI): 4.4.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MobSFMobile-Security-Framework-MobSFbefore 4.4.64.4.6Patch availableCNA
—mobsf (PyPI)before 4.4.64.4.6Patch availableGHSA-hqjr-43r5-9q58
  • Mobile-Security-Framework-MobSF VendorMobSF Affected before 4.4.6 Fixed in 4.4.6 Patch available CNA
  • mobsf (PyPI) Vendor— Affected before 4.4.6 Fixed in 4.4.6 Patch available GHSA-hqjr-43r5-9q58

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:opensecurity:mobile_security_framework:*:*:*:*:*:*:*:*before 4.4.6VulnerableMobSF
  • cpe:2.3:a:opensecurity:mobile_security_framework:*:*:*:*:*:*:*:* Versions before 4.4.6 Vulnerable ·MobSF

Remediation

  • Fix · CNA Mobile-Security-Framework-MobSF (MobSF) Fixed in 4.4.6
  • Fix · GHSA-hqjr-43r5-9q58 mobsf (PyPI) Fixed in 4.4.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33545
  2. 2026-10-03 Alias added: GHSA-hqjr-43r5-9q58

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2024-29048 Mobile Security Framework (MobSF) has a Zip Slip Vulnerability in .a Static Library Files CVSS 3.1CRITICAL 9.8
  • TI-2025-22377 Mobile Security Framework (MobSF) has a SSRF Vulnerability fix bypass on assetlinks_check with DNS Rebinding CVSS 3.1CRITICAL 9.8
  • TI-2025-29076 Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload CVSS 4.0HIGH 8.6
  • TI-2025-18522 Local Privilege Escalation in MobSF CVSS 4.0HIGH 8.5
  • TI-2025-18520 Stored Cross-Site Scripting (XSS) in MobSF CVSS 4.0HIGH 8.4
  • TI-2024-36155 Mobile Security Framework (MobSF) bypass of SSRF fix CVSS 3.1HIGH 7.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences