CVE-2024-53999 Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality

High 8.1 Published 3 Dec 2024 Updated 3 Dec 2024

Attackers can inject malicious scripts via filenames that execute when users view file comparisons, potentially compromising user sessions.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2024-53999?

CVE-2024-53999 is a high-severity cross-site scripting vulnerability in Mobile-Security-Framework-MobSF, published on 3 Dec 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The application allows users to upload files with scripts in the filename parameter. As a result, a malicious user can upload a script file to the system. When users in the application use the "Diff or Compare" functionality, they are affected by a Stored Cross-Site Scripting vulnerability. This vulnerability is fixed in 4.2.9.

Weakness: CWE-79

Which versions are affected by CVE-2024-53999?

3 open source packages ship an affected version, including mobsf. It affects 1 product.

Package	Affected	Fixed in
`mobsf` PyPI	All versions	`4.2.9`
`mobsf` PyPI	All versions	`4.2.9`
`mobsf` PyPI	All versions	`4.2.9`

Products include Opensecurity Mobile Security Framework.

How do I fix CVE-2024-53999?

Upgrade mobsf to 4.2.9 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2024-53999 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-53999 exists.

Sources

Also known as GHSA-5jc6-h9w7-jm3p, PYSEC-2026-1666.