VulnerableCode Package Details - pkg:pypi/mobsf@3.6.0

Search for packages

Vulnerability	Summary	Fixed by
VCID-7uxm-9rw7-gkca Aliases: CVE-2025-31116 PYSEC-2025-48	Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The mitigation for CVE-2024-29190 in valid_host() uses socket.gethostbyname(), which is vulnerable to SSRF abuse using DNS rebinding technique. This vulnerability is fixed in 4.3.2.	4.3.2 Affected by 0 other vulnerabilities.
VCID-dh45-7mwj-vkhp Aliases: CVE-2023-42261 GHSA-cc8j-6phr-jv9x PYSEC-2023-310	Mobile Security Framework (MobSF) <=v3.7.8 Beta is vulnerable to Insecure Permissions. NOTE: the vendor's position is that authentication is intentionally not implemented because the product is not intended for an untrusted network environment. Use cases requiring authentication could, for example, use a reverse proxy server.	3.9.7 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-rgjm-y7h9-sbe8 Aliases: CVE-2024-29190 GHSA-wfgj-wrgh-h3r3 PYSEC-2024-257	Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In version 3.9.5 Beta and prior, MobSF does not perform any input validation when extracting the hostnames in `android:host`, so requests can also be sent to local hostnames. This can lead to server-side request forgery. An attacker can cause the server to make a connection to internal-only services within the organization's infrastructure. Commit 5a8eeee73c5f504a6c3abdf2a139a13804efdb77 has a hotfix for this issue.	3.9.7 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-yqnd-87jt-cyfk Aliases: CVE-2024-54000 GHSA-m435-9v6r-v5f6 PYSEC-2024-256	Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In versions prior to 3.9.7, the requests.get() request in the _check_url method is specified as allow_redirects=True, which allows a server-side request forgery when a request to .well-known/assetlinks.json" returns a 302 redirect. This is a bypass of the fix for CVE-2024-29190 and is fixed in 3.9.7.	3.9.7 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-7uxm-9rw7-gkca
Aliases:
CVE-2025-31116
PYSEC-2025-48

Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The mitigation for CVE-2024-29190 in valid_host() uses socket.gethostbyname(), which is vulnerable to SSRF abuse using DNS rebinding technique. This vulnerability is fixed in 4.3.2.

4.3.2
Affected by 0 other vulnerabilities.

VCID-dh45-7mwj-vkhp
Aliases:
CVE-2023-42261
GHSA-cc8j-6phr-jv9x
PYSEC-2023-310

Mobile Security Framework (MobSF) <=v3.7.8 Beta is vulnerable to Insecure Permissions. NOTE: the vendor's position is that authentication is intentionally not implemented because the product is not intended for an untrusted network environment. Use cases requiring authentication could, for example, use a reverse proxy server.

3.9.7
Affected by 1 other vulnerability.

VCID-rgjm-y7h9-sbe8
Aliases:
CVE-2024-29190
GHSA-wfgj-wrgh-h3r3
PYSEC-2024-257

Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In version 3.9.5 Beta and prior, MobSF does not perform any input validation when extracting the hostnames in `android:host`, so requests can also be sent to local hostnames. This can lead to server-side request forgery. An attacker can cause the server to make a connection to internal-only services within the organization's infrastructure. Commit 5a8eeee73c5f504a6c3abdf2a139a13804efdb77 has a hotfix for this issue.

3.9.7
Affected by 1 other vulnerability.

VCID-yqnd-87jt-cyfk
Aliases:
CVE-2024-54000
GHSA-m435-9v6r-v5f6
PYSEC-2024-256

Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In versions prior to 3.9.7, the requests.get() request in the _check_url method is specified as allow_redirects=True, which allows a server-side request forgery when a request to .well-known/assetlinks.json" returns a 302 redirect. This is a bypass of the fix for CVE-2024-29190 and is fixed in 3.9.7.

3.9.7
Affected by 1 other vulnerability.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-02T04:22:56.013643+00:00	Pypa Importer	Affected by	VCID-7uxm-9rw7-gkca	https://github.com/pypa/advisory-database/blob/main/vulns/mobsf/PYSEC-2025-48.yaml	38.6.0
2026-06-02T04:22:35.994995+00:00	Pypa Importer	Affected by	VCID-yqnd-87jt-cyfk	https://github.com/pypa/advisory-database/blob/main/vulns/mobsf/PYSEC-2024-256.yaml	38.6.0
2026-06-02T04:21:07.785304+00:00	Pypa Importer	Affected by	VCID-rgjm-y7h9-sbe8	https://github.com/pypa/advisory-database/blob/main/vulns/mobsf/PYSEC-2024-257.yaml	38.6.0
2026-06-02T04:19:36.774253+00:00	Pypa Importer	Affected by	VCID-dh45-7mwj-vkhp	https://github.com/pypa/advisory-database/blob/main/vulns/mobsf/PYSEC-2023-310.yaml	38.6.0