The vulnerability is a command injection flaw that allows an attacker to execute arbitrary operating‑system commands through the API endpoints /download_data/, /api/v1/scan, and the Dynamic Analyzer ADB integration module. This flaw maps to CWE‑77, meaning that special characters in input are not properly neutralised before being passed to the shell. Successful exploitation would give the attacker full control over the system running MobSF, allowing data exfiltration, credential theft, or further lateral movement.

Mobile Security Framework (MobSF) version 4.5.2 is affected. Older versions were not listed, and newer releases are not known to contain the fixed code.

An EPSS score of < 1% indicates a low probability of exploitation, but the CVSS score of 9.8 highlights the high severity. This vulnerability leads to remote code execution through exposed HTTP endpoints and the ADB integration, requiring no authentication. An attacker who can send requests or leverage a compromised ADB connection can trigger the flaw. Without mitigation, the likelihood of exploitation remains high given the clear attack surface. The issue is not listed in CISA’s KEV catalog.