CVE-2026-104585: n/a

CVE-2026-104585 identifies a command injection vulnerability in MobSF v4.5.2 specifically affecting the /download_data/ and /api/v1/scan endpoints of the Dynamic Analyzer ADB integration module. This flaw could allow an attacker to execute arbitrary commands on the host running MobSF by injecting malicious input into these endpoints. No CVSS score or detailed vendor advisory information is provided, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the system hosting MobSF, potentially leading to unauthorized access, data compromise, or system control. The exact impact depends on the privileges of the MobSF process and the environment in which it is deployed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoints and consider disabling the Dynamic Analyzer ADB integration module if not required.