MobSF contains a vulnerability in its SQLite Database Viewer Utils. The read_sqlite() function constructs SQL queries using Python string formatting, incorporating attacker‑controlled table names from a database’s sqlite_master table. This flaw enables an attacker to inject malicious SQL, potentially causing denial of service and compromising the integrity of the analysis process.

The issue affects the MobSF Mobile‑Security‑Framework‑MobSF tool, specifically versions before 4.4.6. Users running any version lower than 4.4.6 are vulnerable when they analyze mobile applications that contain a crafted SQLite database.

The vulnerability carries a CVSS score of 5.3, indicating medium severity. Exploitation requires a crafted Android or iOS application with a malicious SQLite database to be analyzed by the vulnerable MobSF instance; it does not provide an arbitrary remote code execution vector. While the probability of widespread exploitation is limited, an analyst can trigger a denial of service or inject unwanted SQL statements if such a payload is processed. The vulnerability is not listed in CISA’s KEV catalog and EPSS data is unavailable.