p PatchFirst

CVE-2025-46335

CVE-2025-46335 · Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. A Stored Cross-Site Scripting (XSS) vulnerability has been identified in MobSF versions up to and including 4.3.2. The vulnerability arises from improper sanitization of user-supplied SVG files during the Android APK analysis workflow. Version 4.3.3 fixes the issue.

CVSS 8.6 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • mobile-security-framework-mobsf

    Versions
    • < 4.3.3: Affected

    No fix published

  • mobsf PyPI

    Versions
    • 3.2.6
    • 3.2.7
    • 3.2.8
    • 3.2.9
    • 3.3.3
    • 3.3.5
    • 3.4.0
    • 3.4.3
    • 3.4.6
    • 3.5.0
    • 3.6.0
    • 3.6.9
    • 3.7.6
    • 3.9.7
    • 4.1.3
    • 4.3.0
    • 4.3.2
    Affected ranges
    • ECOSYSTEM: < 4.3.3

    Update to 4.3.3

Original sources

Check your server →