CVE-2025-24803: MobSF Stored Cross-Site Scripting (XSS) Vulnerability
Summary
CVE-2025-24803: MobSF Stored Cross-Site Scripting (XSS). Affects mobsf versions < 4.3.1. Fixed in 4.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MobSF (Mobile Security Framework) is an open-source tool designed for mobile application security testing. It provides functionalities such as static and dynamic analysis of mobile applications, helping developers identify security vulnerabilities. The framework is widely used for assessing the security posture of iOS and Android applications. However, versions prior to 4.3.1 are vulnerable to a Stored Cross-Site Scripting (XSS) attack, which can compromise user accounts and administrative functionalities.
Vulnerability Detail
The vulnerability arises from improper neutralization of input during web page generation, specifically in the iOS Dynamic Analyzer functionality. An attacker can exploit this vulnerability by uploading a malicious application with a modified CFBundleIdentifier that includes special characters. This allows the attacker to break the HTML context and execute arbitrary scripts in the context of the user's session, potentially leading to unauthorized actions as the user, including administrative privileges.
How To Fix
Latest published version: 4.5.3 as of 23 Oct 2026
pip install --upgrade "mobsf==4.5.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.3.1
This is the first release that contains the fix.
pip install --upgrade "mobsf==4.3.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid uploading applications with modified CFBundleIdentifiers that contain special characters until the patch is applied. Ensure that user input is properly sanitized before rendering it in the web application.
Conclusion
The MobSF Stored Cross-Site Scripting (XSS) vulnerability (CVE-2025-24803) poses a significant risk to users and administrators of the framework. It is crucial to update to version 4.3.1 or later to mitigate this risk. Additionally, employing proper input sanitization techniques can help prevent similar vulnerabilities in the future.
See every vulnerability recorded for mobsf →
FAQ
Stored XSS is a type of security vulnerability where an attacker can inject malicious scripts into a web application, which are then stored on the server and executed when other users access the affected page.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities in real-time.
Exploitation of this vulnerability can allow attackers to perform actions as users, including administrative actions, which can lead to data breaches and unauthorized access.
While the best solution is to update to the patched version, you can mitigate the risk by avoiding the upload of applications with modified CFBundleIdentifiers and ensuring proper input sanitization.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for mobsf.
