https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 18:12:06 +0000 https://cve.radiocsirt.org/vuln/cve-2026-24490 <p><strong>Affected:</strong> MobSF Mobile-Security-Framework-MobSF</p> <p>MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting (XSS) vulnerability in MobSF&#39;s Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim&#39;s browser session by uploading a malicious APK. The `android:host` attribute from `&lt;data android:scheme=&#34;android_secret_code&#34;&gt;` elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover. Version 4.4.5 fixes the issue.</p> <p><strong>Affected:</strong> MobSF Mobile-Security-Framework-MobSF</p> <p>MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting (XSS) vulnerability in MobSF&#39;s Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim&#39;s browser session by uploading a malicious APK. The `android:host` attribute from `&lt;data android:scheme=&#34;android_secret_code&#34;&gt;` elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover. Version 4.4.5 fixes the issue.</p> https://cve.radiocsirt.org/vuln/cve-2026-24490 https://cve.radiocsirt.org/vuln/ghsa-8hf7-h89p-3pqj <p><strong>Affected:</strong> PyPI: mobsf</p> <p>### Summary A Stored Cross-site Scripting (XSS) vulnerability in MobSF&#39;s Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim&#39;s browser session by uploading a malicious APK. The `android:host` attribute from `&lt;data android:scheme=&#34;android_secret_code&#34;&gt;` elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover.</p> <p>### Details When MobSF analyzes an Android APK containing a `&lt;data&gt;` element with `android:scheme=&#34;android_secret_code&#34;`, it extracts the `android:host` attribute and inserts it directly into the analysis report without HTML escaping.</p> <p>### Vulnerable Code Path</p> <p>**1. Data Extraction** - `mobsf/StaticAnalyzer/views/android/manifest_analysis.py` (line 776): ```python xmlhost = data.getAttribute(f&#39;{ns}:host&#39;) ret_list.append((&#39;dialer_code_found&#39;, (xmlhost,), ())) ```</p> <p>**2. Template String Formatting** - `mobsf/StaticAnalyzer/views/android/manifest_analysis.py` (line 806): ```python &#39;title&#39;: a_template[&#39;title&#39;] % t_name, # XSS payload inserted here unescaped ```</p> <p>**3. Template Definition** - `mobsf/StaticAnalyzer/views/android/kb/android_manifest_desc.py` (line 200): ```python &#39;dialer_code_found&#39;: { &#39;title&#39;: &#39;Dailer Code: %s Found &lt;br&gt;[android:scheme=\&#34;android_secret_code\&#34;]&#39;, ... } ```</p> <p>**4. Unsafe Rendering** - `mobsf/templates/static_analysis/android_binary_analysis.html` (line 1143): ```html {{item|key:&#34;title&#34; | safe}} ```</p> <p>The `|safe` Django template filter by…</p> <p><strong>Affected:</strong> PyPI: mobsf</p> <p>### Summary A Stored Cross-site Scripting (XSS) vulnerability in MobSF&#39;s Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim&#39;s browser session by uploading a malicious APK. The `android:host` attribute from `&lt;data android:scheme=&#34;android_secret_code&#34;&gt;` elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover.</p> <p>### Details When MobSF analyzes an Android APK containing a `&lt;data&gt;` element with `android:scheme=&#34;android_secret_code&#34;`, it extracts the `android:host` attribute and inserts it directly into the analysis report without HTML escaping.</p> <p>### Vulnerable Code Path</p> <p>**1. Data Extraction** - `mobsf/StaticAnalyzer/views/android/manifest_analysis.py` (line 776): ```python xmlhost = data.getAttribute(f&#39;{ns}:host&#39;) ret_list.append((&#39;dialer_code_found&#39;, (xmlhost,), ())) ```</p> <p>**2. Template String Formatting** - `mobsf/StaticAnalyzer/views/android/manifest_analysis.py` (line 806): ```python &#39;title&#39;: a_template[&#39;title&#39;] % t_name, # XSS payload inserted here unescaped ```</p> <p>**3. Template Definition** - `mobsf/StaticAnalyzer/views/android/kb/android_manifest_desc.py` (line 200): ```python &#39;dialer_code_found&#39;: { &#39;title&#39;: &#39;Dailer Code: %s Found &lt;br&gt;[android:scheme=\&#34;android_secret_code\&#34;]&#39;, ... } ```</p> <p>**4. Unsafe Rendering** - `mobsf/templates/static_analysis/android_binary_analysis.html` (line 1143): ```html {{item|key:&#34;title&#34; | safe}} ```</p> <p>The `|safe` Django template filter by…</p> https://cve.radiocsirt.org/vuln/ghsa-8hf7-h89p-3pqj