External risk intelligence

MobSF Command Injection Vulnerability in Dynamic Analyzer ADB Integration

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-104585

Mobile Security Framework (MobSF) is a web application and analysis platform frequently deployed as a centralized service or tool for security teams. The vulnerable endpoints (/api/v1/scan and /download_data/) are core components of its web interface and API, which are typically reachable over a network when the application is deployed in a collaborative or automated environment.

Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical command injection vulnerability has been identified in the Mobile Security Framework (MobSF), a tool used for mobile application security testing. This issue allows for unauthorized command execution, posing a significant risk if the framework is publicly accessible or used in automated pipelines. The main concern is confirming relevance and exposure.

Unauthorized commands can be run remotely.
Critical tool for security testing is affected.
Confirm if this security tool is in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests to the Mobile Security Framework's web interface. Because the affected components are part of the core web application and API, and the vulnerability doesn't require authentication or user interaction, an attacker on the network could potentially reach and trigger it. Successful exploitation could lead to significant compromise of the application and its underlying system.

Network access required.
Unauthenticated API endpoints are targeted.
Leads to remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary commands on the server hosting Mobile Security Framework (MobSF). The affected components are related to file downloads and scanning functionalities. When MobSF is deployed in a networked environment, these commands could be executed with the privileges of the MobSF process.

Server-side command execution.
Networked access to vulnerable endpoints.
Unauthorized system modification or data access.

Operational Fix

Recommended remediation, mitigation, and detection steps

Mobile Security Framework (MobSF) is a web application and analysis platform. Given its function, the owners of the application and the infrastructure hosting it are likely responsible for addressing this vulnerability. The first practical step is to identify all deployed instances of MobSF, confirm their network accessibility, assess their criticality, and then assign ownership for remediation planning based on the identified risk.

Own by application and infrastructure teams.
Verify network exposure and asset criticality.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Mobile Security Framework (MobSF)?

MobSF is an automated, all-in-one mobile application security testing platform capable of performing static and dynamic analysis on Android, iOS, and Windows binaries. It is widely used by security professionals to identify vulnerabilities during the development lifecycle. Version 4.5.2 is specifically affected by this issue, which involves components responsible for processing mobile data and interacting with device bridges.

How does this CVE-2026-104585 vulnerability work?

This vulnerability is classified as Command Injection (CWE-77). It occurs when an application improperly filters input before passing it to a system shell. In this case, attackers can insert their own malicious commands into specific MobSF endpoints. Because the system executes these commands directly, an attacker can manipulate the host server, effectively treating the MobSF platform as a gateway to gain unauthorized control over the underlying operating system.

What triggers the command injection in MobSF?

The flaw is triggered by sending specially crafted web requests to the /download_data/ or /api/v1/scan endpoints, or by interacting with the Dynamic Analyzer ADB integration module. Crucially, the vulnerability does not require authentication or user interaction to trigger. Simply accessing these network-reachable endpoints with malicious input is sufficient; legitimate traffic that does not contain injected shell commands will not trigger the defect.

Is my MobSF instance at risk?

According to Halo Surface Signal, this vulnerability is highly relevant if your MobSF deployment is reachable over a network. Because MobSF is often used as a centralized, collaborative service, it is frequently exposed to internal or external networks. If your instance is accessible to other users or automated systems on your network, it could be targeted. You should prioritize assessing instances that are not strictly isolated.

How should I respond to this MobSF advisory?

Start by identifying all instances of MobSF running in your environment to understand your total footprint. Once located, verify their network accessibility to determine which ones are exposed. Assign ownership to the application or infrastructure teams responsible for those specific servers. Avoid exposing the application interface to untrusted networks while you coordinate with the vendor to plan and apply the necessary security updates.

References

github.com/AmalJafarzade/CVE-2026-104585

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.