Search for packages
| purl | pkg:pypi/mobsf@3.9.7 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-7uxm-9rw7-gkca
Aliases: CVE-2025-31116 PYSEC-2025-48 |
Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The mitigation for CVE-2024-29190 in valid_host() uses socket.gethostbyname(), which is vulnerable to SSRF abuse using DNS rebinding technique. This vulnerability is fixed in 4.3.2. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-dh45-7mwj-vkhp | Mobile Security Framework (MobSF) <=v3.7.8 Beta is vulnerable to Insecure Permissions. NOTE: the vendor's position is that authentication is intentionally not implemented because the product is not intended for an untrusted network environment. Use cases requiring authentication could, for example, use a reverse proxy server. |
CVE-2023-42261
GHSA-cc8j-6phr-jv9x PYSEC-2023-310 |
| VCID-rgjm-y7h9-sbe8 | Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In version 3.9.5 Beta and prior, MobSF does not perform any input validation when extracting the hostnames in `android:host`, so requests can also be sent to local hostnames. This can lead to server-side request forgery. An attacker can cause the server to make a connection to internal-only services within the organization's infrastructure. Commit 5a8eeee73c5f504a6c3abdf2a139a13804efdb77 has a hotfix for this issue. |
CVE-2024-29190
GHSA-wfgj-wrgh-h3r3 PYSEC-2024-257 |
| VCID-yqnd-87jt-cyfk | Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In versions prior to 3.9.7, the requests.get() request in the _check_url method is specified as allow_redirects=True, which allows a server-side request forgery when a request to .well-known/assetlinks.json" returns a 302 redirect. This is a bypass of the fix for CVE-2024-29190 and is fixed in 3.9.7. |
CVE-2024-54000
GHSA-m435-9v6r-v5f6 PYSEC-2024-256 |
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-02T04:45:51.806841+00:00 | GitLab Importer | Fixing | VCID-dh45-7mwj-vkhp | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/mobsf/CVE-2023-42261.yml | 38.6.0 |
| 2026-06-02T04:22:56.025468+00:00 | Pypa Importer | Affected by | VCID-7uxm-9rw7-gkca | https://github.com/pypa/advisory-database/blob/main/vulns/mobsf/PYSEC-2025-48.yaml | 38.6.0 |
| 2026-06-02T04:22:36.006210+00:00 | Pypa Importer | Fixing | VCID-yqnd-87jt-cyfk | https://github.com/pypa/advisory-database/blob/main/vulns/mobsf/PYSEC-2024-256.yaml | 38.6.0 |
| 2026-06-02T04:21:07.796848+00:00 | Pypa Importer | Fixing | VCID-rgjm-y7h9-sbe8 | https://github.com/pypa/advisory-database/blob/main/vulns/mobsf/PYSEC-2024-257.yaml | 38.6.0 |
| 2026-06-02T04:19:36.788756+00:00 | Pypa Importer | Fixing | VCID-dh45-7mwj-vkhp | https://github.com/pypa/advisory-database/blob/main/vulns/mobsf/PYSEC-2023-310.yaml | 38.6.0 |