CVE-2026-33545: MobSF SQL Injection Vulnerability in SQLite Database Viewer
Summary
CVE-2026-33545: MobSF has SQL Injection in its SQLite Database Viewer Utils. Affects mobsf versions < 4.4.6. Fixed in 4.4.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MobSF (Mobile Security Framework) is an open-source tool designed for mobile application security analysis. It provides dynamic and static analysis capabilities for both Android and iOS applications, allowing security analysts to identify vulnerabilities and security issues within mobile apps. The framework includes various utilities for analyzing SQLite databases, which are commonly used in mobile applications to store data. However, MobSF has a critical vulnerability that allows SQL injection through its SQLite Database Viewer Utils, compromising the integrity of the analysis process.
Vulnerability Detail
The vulnerability arises from the read_sqlite() function in MobSF's utils.py file, where SQL queries are constructed using Python string formatting without proper parameterization or escaping. This allows attacker-controlled table names from a malicious SQLite database to be directly interpolated into SQL queries. The consequences include potential denial of service, where a crafted table name can crash the database viewer, and SQL injection, enabling attackers to retrieve unauthorized data. The vulnerability is confirmed in both dynamic and static analysis contexts, posing a significant risk to security analysts relying on MobSF for accurate app assessments.
How To Fix
Latest published version: 4.5.3 as of 23 Oct 2026
pip install --upgrade "mobsf==4.5.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.4.6
This is the first release that contains the fix.
pip install --upgrade "mobsf==4.4.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid analyzing SQLite databases from untrusted or unknown sources until the vulnerability is patched. Additionally, consider implementing input validation and sanitization for table names before processing them in the read_sqlite() function.
Conclusion
CVE-2026-33545 is a significant vulnerability in MobSF that exposes users to SQL injection risks through its SQLite Database Viewer. It is crucial for users to update to the patched version or implement the suggested code changes to secure their applications. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for mobsf →
FAQ
CVE-2026-33545 is a vulnerability in MobSF that allows SQL injection through its SQLite Database Viewer, potentially leading to unauthorized data access or denial of service.
Versions of MobSF prior to 4.4.6 are affected by this vulnerability. Check your version by running pip show mobsf in your terminal.
The vulnerability can lead to denial of service, where the database viewer crashes, and SQL injection, allowing attackers to retrieve sensitive data.
Update MobSF to version 4.4.6 or later to mitigate the vulnerability. You can also implement input validation for table names as a temporary measure.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against this vulnerability using the Vulert playground at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for mobsf.
