8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24490

CVE-2026-24490: MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field

MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The android:host attribute from <data android:scheme="android_secret_code"> elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover. Version 4.4.5 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24490

CVE-2026-24490:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mobsf	pip	< 4.4.5	4.4.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic stored Cross-Site Scripting (XSS) issue. The root cause is the failure to sanitize user-provided input from an Android APK's manifest file before rendering it in an HTML report. The analysis of the patch commit 2b08dd050e7685ee2a14fdbb454affab94129eae clearly shows the remediation steps.

Input Processing: The function manifest_analysis in mobsf/StaticAnalyzer/views/android/manifest_analysis.py is responsible for parsing the AndroidManifest.xml file. The patch shows that this function was modified to add sanitization.
Vulnerable Code: Specifically, the code that extracts the android:host attribute was identified as the source of the vulnerability. The line xmlhost = data.getAttribute(f'{ns}:host') reads the potentially malicious data.
The Fix: The patch introduces a new helper function, escape_manifest_attribute, which uses Django's escape() utility. This function is then called on the xmlhost variable immediately after it's read: xmlhost = escape_manifest_attribute(xmlhost). This change ensures that any HTML tags within the android:host attribute are escaped and rendered as plain text, preventing script execution.
Template Sink: The patch also removes the |safe filter from the Django template (mobsf/templates/static_analysis/android_binary_analysis.html). Previously, {{item|key:"title" | safe}} explicitly told Django to render the content as raw HTML, which is what allowed the XSS payload to execute. Removing |safe enforces Django's default auto-escaping, providing a defense-in-depth mitigation.

Therefore, the manifest_analysis function is the primary vulnerable function as it is responsible for processing the malicious input from the APK and failing to secure it before passing it to the template for rendering.

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.