{"id":"CVE-2026-104585","published":"2026-10-13T20:17:12.723","lastModified":"2026-10-16T19:56:15.773","description":"Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api/v1/scan, Dynamic Analyzer ADB integration module.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-77"],"vendors":[],"products":[],"references":[{"url":"https://github.com/AmalJafarzade/CVE-2026-104585","tags":[]},{"url":"https://github.com/MobileSecurityFramework/Mobile-Security-Framework-MobSF/blob/master/mobsf/DynamicAnalyzer/views/android/tests_common.py","tags":[]},{"url":"https://github.com/AmalJafarzade/CVE-2026-104585","tags":[]}],"exploitRefs":[{"url":"https://github.com/AmalJafarzade/CVE-2026-104585","tags":[]},{"url":"https://github.com/MobileSecurityFramework/Mobile-Security-Framework-MobSF/blob/master/mobsf/DynamicAnalyzer/views/android/tests_common.py","tags":[]},{"url":"https://github.com/AmalJafarzade/CVE-2026-104585","tags":[]}],"hasPoc":true,"ai":{"summary":"MobSF v4.5.2 contains a command injection vulnerability in its Dynamic Analyzer ADB integration module that allows attackers to execute arbitrary commands on the server with the privileges of the MobSF process, potentially leading to full system compromise.","exploitability":"The vulnerability is highly exploitable with no authentication required, as it affects publicly accessible endpoints (/download_data/ and /api/v1/scan) that accept user-supplied input directly passed to system commands without proper sanitization.","blast_radius":"If exploited, attackers could gain complete control over the MobSF server, potentially accessing all analyzed mobile applications, their source code, and sensitive metadata stored in the system.","remediation":"Upgrade to MobSF v4.5.3 or later to remediate this command injection vulnerability.","detection":"Monitor for suspicious command execution patterns in application logs when requests are made to /download_data/ and /api/v1/scan endpoints, particularly if commands contain unexpected shell metacharacters or external command invocations.","tags":["rce","command-injection","mobile-security","web"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:47:12.725Z"}}