CVE-2026-24490: 
Python vulnerability analysis and mitigation

CVE-2026-24490 is a Stored Cross-Site Scripting (XSS) vulnerability in Mobile Security Framework (MobSF), a widely used mobile application security testing tool. The flaw exists in MobSF's Android manifest analysis feature, where the android:host attribute from <data android:scheme="android_secret_code"> elements is rendered in HTML analysis reports without sanitization, allowing an attacker to execute arbitrary JavaScript in a victim's browser session. All versions prior to 4.4.5 are affected (pip package mobsf < 4.4.5). The vulnerability was published on January 26, 2026, with a patch released the same day. It carries a CVSS v3.1 base score of 8.1 (High) per the GitHub Advisory, reflecting high confidentiality and integrity impact with a changed scope (Github Advisory, MobSF Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the use of Django's |safe template filter on user-controlled data. The vulnerable code path begins in mobsf/StaticAnalyzer/views/android/manifest_analysis.py (line 776), where xmlhost = data.getAttribute(f'{ns}:host') extracts the android:host attribute without sanitization. This value is then formatted into a title string via Python's % operator (line 806) and rendered in mobsf/templates/static_analysis/android_binary_analysis.html (line 1143) using {{item|key:"title" | safe}}, which bypasses Django's auto-escaping entirely. An attacker must have sufficient privileges to upload an APK to the MobSF instance, but exploitation then requires only that any authenticated user views the resulting analysis report (MobSF Advisory, Github Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser context of any MobSF user who views the poisoned analysis report, enabling session hijacking, credential theft, and account takeover. Because MobSF is often deployed as a shared internal security analysis platform, a single malicious APK upload can compromise the sessions of multiple analysts. The CVSS assessment rates both confidentiality and integrity impact as High, reflecting the potential for full account compromise and unauthorized actions within the victim's authenticated session (MobSF Advisory, Github Advisory).

A proof-of-concept (PoC) APK (POC_XSS_APK.apk, MD5: 647258656ed03a7e6a0f2acce4ec6a5b) is publicly available and was confirmed to work against the MobSF public instance (mobsf.live). The GitHub Advisory includes detailed step-by-step reproduction instructions. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.025% (7th percentile), indicating low near-term exploitation probability. The vulnerability is not listed in the CISA KEV catalog (MobSF Advisory, Github Advisory).

1. Craft malicious APK: Create an AndroidManifest.xml containing a <data android:scheme="android_secret_code" android:host="<script>alert(document.cookie)</script>"> element (or a more sophisticated payload for session theft) within an intent filter.
2. Build the APK: Use apktool or standard Android build tools to package the manifest into a valid APK file.
3. Upload to MobSF: Using an account with APK upload privileges, submit the malicious APK to the target MobSF instance for static analysis.
4. Wait for victim interaction: The stored XSS payload is now embedded in the generated HTML analysis report. Any authenticated user who navigates to the report page will trigger automatic JavaScript execution in their browser.
5. Harvest session data: The JavaScript payload can exfiltrate session cookies, authentication tokens, or perform actions on behalf of the victim within MobSF, enabling account takeover (MobSF Advisory).

• Network: Outbound HTTP requests from a victim's browser to an attacker-controlled server originating from MobSF report pages; unexpected cross-origin requests from the MobSF web interface.
• File System: Presence of a suspicious APK file (e.g., MD5 647258656ed03a7e6a0f2acce4ec6a5b) in the MobSF upload directory.
• Logs: MobSF access logs showing analysis reports for APKs with unusual android:host values containing HTML/JavaScript characters (<, >, script, onerror, etc.); browser console errors related to Content Security Policy violations on report pages.
• Application: Analysis reports in MobSF displaying malformed or truncated "Dialer Code" entries in the manifest analysis section, or reports triggering unexpected browser dialogs/redirects when viewed (MobSF Advisory).

Upgrade MobSF to version 4.4.5 or later, which removes all |safe template filter usages and properly sanitizes the android:host attribute before rendering it in HTML reports. The fix is included in commit 2b08dd050e7685ee2a14fdbb454affab94129eae. For environments unable to patch immediately: restrict APK upload permissions to trusted users only, implement network segmentation to limit access to MobSF instances, and consider adding Content Security Policy (CSP) headers to reduce XSS impact. The pip package can be updated via pip install --upgrade mobsf (MobSF Release, MobSF Commit).

The vulnerability was discovered and reported by security researcher smaranchand and disclosed through coordinated responsible disclosure with the MobSF maintainer ajinabraham. The advisory was published simultaneously with the patch on January 26, 2026. Brief community discussion was observed on Bluesky and security aggregator sites shortly after disclosure, consistent with a medium-severity tool-specific vulnerability. No major media coverage or significant vendor statements beyond the official advisory have been identified (MobSF Advisory).