MobSF’s read_sqlite() function builds SQL queries using Python string formatting, incorporating table names directly from a SQLite database’s schema. A malicious database crafted by an attacker can introduce table names that, when interpolated into the query, trigger arbitrary SQL statements or corrupt execution flow. The vulnerability can lead to a denial of service and may expose internal database contents, matching CWE‑89.

Mobile Security Framework (MobSF) versions prior to 4.4.6 are affected. Analysts running these versions with a crafted SQLite database can be exposed. Version 4.4.6 and later contain the fix, removing the unsafe string construction.

The CVSS base score of 5.3 indicates moderate severity. EPSS below 1 % reflects a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to supply a malicious database to the MobSF analysis environment, so the attack vector is local and depends on the analyst’s trust of inputs. Patching to 4.4.6 eliminates the risk.