CVE-2026-104585: Command Injection
Published Oct 13, 2026
·Updated
Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /downloaddata/, /api/v1/scan, Dynamic Analyzer ADB integration module.
Affected Software
1 affected component
MobSF Mobile Security Framework (MobSF)=4.5.2
Event History
Oct 13, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
Which MobSF components and endpoints are affected?
The affected areas are the /download_data/ endpoint, the /api/v1/scan endpoint, and the Dynamic Analyzer ADB integration module in MobSF v4.5.2.
2
What vulnerability class should defenders investigate?
This issue is classified as command injection. Review how input reaching the listed endpoints and the Dynamic Analyzer ADB integration is passed to operating-system commands.