CVE-2026-33545

Description

MobSF is a mobile application security testing tool used. Prior to version 4.4.6, MobSFs read_sqlite() function in mobsf/MobSF/utils.py (lines 542-566) uses Python string formatting (%) to construct SQL queries with table names read from a SQLite databases sqlite_master table. When a security analyst uses MobSF to analyze a malicious mobile application containing a crafted SQLite database, attacker-controlled table names are interpolated directly into SQL queries without parameterization or escaping. This allows an attacker to cause denial of service and achieve SQL injection. Version 4.4.6 patches the issue.

Risk Information

Base Score

6.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS Score

Exploitation Probability

0.036

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2026-33545 are fixed in Python-mobsf 4.4.6	Windows
Vulnerabilities CVE-2026-33545 are fixed in Python-mobsf for linux 4.4.6	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234