{"cve":"CVE-2026-33545","nvd":{"published":"2026-03-26T21:17:06.047","modified":"2026-06-17T10:37:41.213","status":"Analyzed","description":"MobSF is a mobile application security testing tool used. Prior to version 4.4.6, MobSF's `read_sqlite()` function in `mobsf/MobSF/utils.py` (lines 542-566) uses Python string formatting (`%`) to construct SQL queries with table names read from a SQLite database's `sqlite_master` table. When a security analyst uses MobSF to analyze a malicious mobile application containing a crafted SQLite database, attacker-controlled table names are interpolated directly into SQL queries without parameterization or escaping. This allows an attacker to cause denial of service and achieve SQL injection. Version 4.4.6 patches the issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","score":6.5},"cwes":["CWE-89"],"references":["https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/6f8a43c1b78d21cfbd7186aaafa7f622d990e0f1","https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.4.6","https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-hqjr-43r5-9q58"],"products":["opensecurity:mobile_security_framework"],"source":"nvd","synced_at":"2026-10-19T22:28:18.033120106+00:00"},"epss":{"cve":"CVE-2026-33545","score":0.00286,"percentile":0.21213,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-hqjr-43r5-9q58","url":"https://osv.dev/vulnerability/GHSA-hqjr-43r5-9q58","summary":"MobSF has SQL Injection in its SQLite Database Viewer Utils","modified":"2026-07-13T16:42:29.900455777Z","packages":[{"ecosystem":"PyPI","name":"mobsf","purl":"pkg:pypi/mobsf","ranges":["<4.4.6"],"fixed":["4.4.6"]}]},{"id":"PYSEC-2026-2662","url":"https://osv.dev/vulnerability/PYSEC-2026-2662","summary":"MobSF has SQL Injection in its SQLite Database Viewer Utils","modified":"2026-07-13T16:31:52.090592467Z","packages":[{"ecosystem":"PyPI","name":"mobsf","purl":"pkg:pypi/mobsf","ranges":["<4.4.6"],"fixed":["4.4.6"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}