MobSF vulnerabilities
We track 4 vulnerabilities in MobSF products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on March 31, 2025.
Latest MobSF vulnerabilities
- 9.8 Critical severity
Mobile-Security-Framework-MobSF: Server-Side Request Forgery
Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The mitigation for CVE-2024-29190 in valid_host() uses socket.gethostbyname(), which is vulnerable to SSRF
- 7.5 High severity
Mobile-Security-Framework-MobSF: Server-Side Request Forgery
Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In versions prior to 3.9.7, the requests.get() request in the _check_url method is specified as allow_redi
- 9.8 Critical severity
Mobile-Security-Framework-MobSF: Improper Limitation of a Pathname to a Restricted Directory
Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. Before 4.0.7, there is a flaw in the Static Libraries analysis section. Specifically, during the extractio
- 7.5 High severity
Mobile-Security-Framework-MobSF: Server-Side Request Forgery
Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In version 3.9.5 Beta and prior, MobSF does not perform any input validation when extracting the hostnames