CVE-2026-104585

Summary

MobSF v4.5.2 contains a command injection vulnerability in its Dynamic Analyzer ADB integration module that allows attackers to execute arbitrary commands on the server with the privileges of the MobSF process, potentially leading to full system compromise.

Exploitability

The vulnerability is highly exploitable with no authentication required, as it affects publicly accessible endpoints (/download_data/ and /api/v1/scan) that accept user-supplied input directly passed to system commands without proper sanitization.

Blast radius

If exploited, attackers could gain complete control over the MobSF server, potentially accessing all analyzed mobile applications, their source code, and sensitive metadata stored in the system.

Detection

Monitor for suspicious command execution patterns in application logs when requests are made to /download_data/ and /api/v1/scan endpoints, particularly if commands contain unexpected shell metacharacters or external command invocations.

Prioritized remediation

Upgrade to MobSF v4.5.3 or later to remediate this command injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.