CVE-2026-33545
published 2026-03-26CVE-2026-33545: MobSF is a mobile application security testing tool used. Prior to version 4.4.6, MobSF's `read_sqlite()` function in `mobsf/MobSF/utils.py` (lines 542-566)…
PriorityP336medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
0.28%
19.3th percentile
MobSF is a mobile application security testing tool used. Prior to version 4.4.6, MobSF's `read_sqlite()` function in `mobsf/MobSF/utils.py` (lines 542-566) uses Python string formatting (`%`) to construct SQL queries with table names read from a SQLite database's `sqlite_master` table. When a security analyst uses MobSF to analyze a malicious mobile application containing a crafted SQLite database, attacker-controlled table names are interpolated directly into SQL queries without parameterization or escaping. This allows an attacker to cause denial of service and achieve SQL injection. Version 4.4.6 patches the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mobsf | mobile-security-framework-mobsf | < 4.4.6 | 4.4.6 |
| opensecurity | mobile_security_framework | < 4.4.6 | 4.4.6 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
MobSF has SQL Injection in its SQLite Database Viewer Utils
osv·2026-03-24
CVE-2026-33545 [MEDIUM] MobSF has SQL Injection in its SQLite Database Viewer Utils
MobSF has SQL Injection in its SQLite Database Viewer Utils
## Description
MobSF's `read_sqlite()` function in `mobsf/MobSF/utils.py` (lines 542-566) uses Python string formatting (`%`) to construct SQL queries with table names read from a SQLite database's `sqlite_master` table. When a security analyst uses MobSF to analyze a malicious mobile application containing a crafted SQLite database, attacker-controlled table names are interpolated directly into SQL queries without parameterization or escaping.
This allows an attacker to:
1. **Cause Denial of Service** -- A malicious table name causes the database viewer to crash, preventing the analyst from viewing ANY data in the SQLite database. A malicious app can use this to hide sensitive data (C2 server URLs, stolen credentials, API key
GHSA
MobSF has SQL Injection in its SQLite Database Viewer Utils
ghsa·2026-03-24
CVE-2026-33545 [MEDIUM] CWE-89 MobSF has SQL Injection in its SQLite Database Viewer Utils
MobSF has SQL Injection in its SQLite Database Viewer Utils
## Description
MobSF's `read_sqlite()` function in `mobsf/MobSF/utils.py` (lines 542-566) uses Python string formatting (`%`) to construct SQL queries with table names read from a SQLite database's `sqlite_master` table. When a security analyst uses MobSF to analyze a malicious mobile application containing a crafted SQLite database, attacker-controlled table names are interpolated directly into SQL queries without parameterization or escaping.
This allows an attacker to:
1. **Cause Denial of Service** -- A malicious table name causes the database viewer to crash, preventing the analyst from viewing ANY data in the SQLite database. A malicious app can use this to hide sensitive data (C2 server URLs, stolen credentials, API key
No detection rules found.
No public exploits indexed.
2026-03-26
Published