- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 22 · 9 high, 10 medium, 2 low
- Weekly downloads
- 952
- Dependents
- 0
- Registry
- PyPI
Advisories 22
- CVE-2026-68923Medium 6.5
MobSF: CSRF checks not enforced after Django migration
Affected: fixed in 4.5.1.
- CVE-2026-68927Low 3.0
MobSF: SSRF port restriction bypass in assetlinks_check
Affected: fixed in 4.5.1.
- CVE-2026-68922Medium 5.5
MobSF: Arbitrary File Read via Path Traversal in ZIP Uploads
Affected: fixed in 4.5.1.
- CVE-2026-68924Medium 4.9
MobSF: Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction
Affected: fixed in 4.5.1.
- CVE-2026-33545Medium 5.3
MobSF has SQL Injection in its SQLite Database Viewer Utils
Affected: fixed in 4.4.6.
- CVE-2026-24490High 8.1
MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field
Affected: fixed in 4.4.5.
- CVE-2025-58162Medium 6.5
MobSF Vulnerable to Arbitrary File Write (AR-Slip) via Absolute Path in .a Extraction
Affected: fixed in 4.4.1.
- CVE-2025-58161Low 1.3
MobSF Path Traversal in GET /download/<filename> using absolute filenames
Affected: fixed in 4.4.1.
- CVE-2025-46730Medium 6.8
Mobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death Attack
Affected: through 4.3.2.
- CVE-2025-46335High 8.6
Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload
Affected: fixed in 4.3.3.
- CVE-2025-31116Medium 4.4
Mobile Security Framework (MobSF) has a SSRF Vulnerability fix bypass on assetlinks_check with DNS Rebinding
Affected: fixed in 4.3.2; fixed in 4.3.2.
- CVE-2025-24803High 8.4
Stored Cross-Site Scripting (XSS) in MobSF
Affected: fixed in 4.3.1.
- CVE-2025-24804Medium 4.8
Partial Denial of Service (DoS) in MobSF
Affected: fixed in 4.3.1.
- CVE-2025-24805High 8.5
Local Privilege Escalation in MobSF
Affected: fixed in 4.3.1.
- CVE-2024-53999High 8.1
Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality
Affected: fixed in 4.2.9.
Show all 22 advisoriesShow fewer advisories
- CVE-2024-54000High 7.5
Mobile Security Framework (MobSF) bypass of SSRF fix
Affected: fixed in 3.9.7.
- CVE-2024-43399High 8.0
Mobile Security Framework (MobSF) has a Zip Slip Vulnerability in .a Static Library Files
Affected: fixed in 4.0.7.
- CVE-2024-41955Medium 5.2
Mobile Security Framework (MobSF) has an Open Redirect in Login Redirect
Affected: fixed in 4.0.5.
- CVE-2024-31215Medium 6.3
Mobile Security Framework (MobSF) vulnerable to Server-Side Request Forgery (SSRF) in firebase database check
Affected: fixed in 3.9.8.
- CVE-2024-29190High 7.5
MobSF SSRF Vulnerability on assetlinks_check(act_name, well_knowns)
Affected: fixed in 3.9.7.
- CVE-2023-42261Unrated
Mobile Security Framework (MobSF) <=v3.7.8 Beta is vulnerable to Insecure Permissions.
Affected: fixed in 3.9.7.
- CVE-2022-41547High 7.5
Mobile Security Framework (MobSF) v0.9.2 and below was discovered to contain a local file inclusion (LFI) vulnerability in the…
Affected: fixed in 0.9.3.