https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T14:24:34.979720+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-24490 CVE-2026-24490 — MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field 2026-10-03T14:24:35.011241+00:00

Affected: MobSF Mobile-Security-Framework-MobSF

MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The `android:host` attribute from `<data android:scheme="android_secret_code">` elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover. Version 4.4.5 fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-8hf7-h89p-3pqj GHSA-8hf7-h89p-3pqj — MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field 2026-10-03T14:24:35.011332+00:00

Affected: PyPI: mobsf

### Summary A Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The `android:host` attribute from `<data android:scheme="android_secret_code">` elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover.

### Details When MobSF analyzes an Android APK containing a `<data>` element with `android:scheme="android_secret_code"`, it extracts the `android:host` attribute and inserts it directly into the analysis report without HTML escaping.

### Vulnerable Code Path

**1. Data Extraction** - `mobsf/StaticAnalyzer/views/android/manifest_analysis.py` (line 776): ```python xmlhost = data.getAttribute(f'{ns}:host') ret_list.append(('dialer_code_found', (xmlhost,), ())) ```

**2. Template String Formatting** - `mobsf/StaticAnalyzer/views/android/manifest_analysis.py` (line 806): ```python 'title': a_template['title'] % t_name, # XSS payload inserted here unescaped ```

**3. Template Definition** - `mobsf/StaticAnalyzer/views/android/kb/android_manifest_desc.py` (line 200): ```python 'dialer_code_found': { 'title': 'Dailer Code: %s Found <br>[android:scheme=\"android_secret_code\"]', ... } ```

**4. Unsafe Rendering** - `mobsf/templates/static_analysis/android_binary_analysis.html` (line 1143): ```html {{item|key:"title" | safe}} ```

The `|safe` Django template filter by…