MobSF Mobile-Security-Framework versions before 4.4.6 contain a SQL injection vulnerability (CWE-89) in the read_sqlite() function located in mobsf/MobSF/utils.py. This function constructs SQL queries by directly interpolating table names obtained from the SQLite sqlite_master table using Python's % string formatting without parameterization or escaping. An attacker can exploit this by providing a malicious SQLite database with crafted table names, leading to SQL injection and denial of service. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity) and was publicly disclosed on 2026-03-26. The issue is fixed in MobSF version 4.4.6.

Successful exploitation allows an attacker to cause denial of service and execute SQL injection attacks within the context of MobSF's database querying functionality when analyzing malicious mobile applications. There is no impact on confidentiality or integrity reported, but availability is affected. No known exploits are reported in the wild.

Upgrade MobSF to version 4.4.6 or later, where this vulnerability is patched. Users running affected versions prior to 4.4.6 should apply the official update to remediate the issue. No other mitigation or temporary fix is documented.