CVE-2026-104585: MobSF Command Injection RCE Vulnerability

CVE-2026-104585 Overview

CVE-2026-104585 is a command injection vulnerability in Mobile Security Framework (MobSF) version 4.5.2. The flaw affects multiple components, including the /download_data/ endpoint, the /api/v1/scan API, and the Dynamic Analyzer Android Debug Bridge (ADB) integration module. An attacker who can reach these endpoints can inject shell commands that execute in the context of the MobSF process. MobSF is widely deployed in mobile application security pipelines, so exploitation can expose source code, scan artifacts, and the host operating system to attacker control.

Critical Impact
Command injection in MobSF v4.5.2 allows attackers to execute arbitrary operating system commands on the host running the scanner.

Affected Products

Mobile Security Framework (MobSF) v4.5.2
MobSF Dynamic Analyzer ADB integration module
MobSF REST API endpoint /api/v1/scan

Discovery Timeline

2026-10-13 - CVE-2026-104585 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-104585

Vulnerability Analysis

MobSF is an automated analysis framework used to assess Android and iOS applications. Version 4.5.2 contains command injection flaws across three distinct code paths. The /download_data/ endpoint and the /api/v1/scan API accept user-controlled parameters that reach a shell interpreter without sufficient sanitization. The Dynamic Analyzer ADB integration module composes adb command lines using attacker-influenced input before invoking a system shell. An attacker who can submit a crafted scan request or trigger a dynamic analysis action can append or substitute arbitrary shell metacharacters. The injected commands run with the privileges of the MobSF service account on the analysis host.

Root Cause

The root cause is improper neutralization of special elements used in operating system commands [CWE-78]. User-supplied values flow into shell invocations in tests_common.py and related view handlers without strict allow-listing or safe argument passing. See the Mobile Security Framework source for tests_common.py for the affected code path.

Attack Vector

Exploitation requires network access to a MobSF v4.5.2 instance. An attacker sends a crafted HTTP request to /download_data/ or /api/v1/scan, or triggers an ADB operation through the Dynamic Analyzer with a malicious parameter. The injected payload uses shell metacharacters such as ;, |, or backticks to append commands to the invoked process. Successful exploitation yields arbitrary command execution, enabling credential theft, lateral movement, and tampering with scan results. A proof of concept is published in the CVE-2026-104585 PoC repository.

No verified exploit code is reproduced here. Technical details of the injection sinks are available in the referenced source and PoC repositories.

Detection Methods for CVE-2026-104585

Indicators of Compromise

Child processes such as sh, bash, or adb spawned by the MobSF Python process with unusual command-line arguments.
Outbound network connections from the MobSF host to unknown destinations following requests to /download_data/ or /api/v1/scan.
Unexpected files written to the MobSF upload or scan output directories outside normal scan workflows.

Detection Strategies

Inspect web server and application logs for requests to /download_data/ and /api/v1/scan containing shell metacharacters (;, |, &, backticks, $()).
Alert on MobSF process trees that launch shells, interpreters, or network utilities such as curl, wget, or nc.
Correlate Dynamic Analyzer activity with ADB command executions that contain unexpected arguments or target non-standard binaries.

Monitoring Recommendations

Enable verbose request logging on the MobSF reverse proxy and retain logs for forensic review.
Monitor filesystem changes under the MobSF installation directory and scan workspace.
Baseline normal adb invocations issued by the Dynamic Analyzer and alert on deviations.

How to Mitigate CVE-2026-104585

Immediate Actions Required

Restrict network access to MobSF instances to trusted analysts and CI/CD pipelines using firewall rules or a VPN.
Disable the Dynamic Analyzer module if ADB-based testing is not required in the deployment.
Review access logs for /download_data/ and /api/v1/scan requests containing suspicious characters.

Patch Information

At the time of publication, no fixed version has been listed in the NVD entry for CVE-2026-104585. Monitor the Mobile Security Framework repository for an updated release that addresses the command injection sinks in tests_common.py and the affected view handlers. Upgrade MobSF immediately once a patched version is released.

Workarounds

Run MobSF inside an isolated container or virtual machine with no outbound internet access and no sensitive credentials mounted.
Enforce authentication on the MobSF web interface and API, and rotate the API key used by /api/v1/scan.
Place MobSF behind a reverse proxy that filters shell metacharacters in request parameters bound for /download_data/ and /api/v1/scan.

bash

# Example: restrict MobSF to localhost and require VPN access
# /etc/nginx/conf.d/mobsf.conf
server {
    listen 127.0.0.1:8000;
    location / {
        proxy_pass http://mobsf_upstream;
        # Reject requests containing shell metacharacters
        if ($args ~* "[;|&`$()]") { return 400; }
    }
}