{"id":"CVE-2026-24490","aliases":["GHSA-8hf7-h89p-3pqj","PYSEC-2026-1668"],"url":"https://o3.security/vulnerability/CVE-2026-24490","summary":"MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field","details":"MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The `android:host` attribute from `<data android:scheme=\"android_secret_code\">` elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover. Version 4.4.5 fixes the issue.","published":"2026-01-27T00:40:36.483Z","modified":"2026-07-15T01:48:58.518309479Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"mobsf","fixedVersion":"4.4.5"}],"fix":{"url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/2b08dd050e7685ee2a14fdbb454affab94129eae","label":"MobSF/Mobile-Security-Framework-MobSF@2b08dd0"},"references":[{"type":"WEB","url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.4.5"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24490.json"},{"type":"ADVISORY","url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-8hf7-h89p-3pqj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24490"},{"type":"FIX","url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/2b08dd050e7685ee2a14fdbb454affab94129eae"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-15T01:48:58.518309479Z"}}