MobSF/Mobile-Security-Framework-MobSF v4.5.3

on GitHub

v4.5.3 Changelog

• Features or Enhancements

  • Added REST API support for viewing decompiled Android XML (type=xml on api/v1/view_source) for APK, Android Studio source ZIP, and AAR scans
  • Bumped the MobSF signature pack
  • 4.5.3 dependency and supply-chain refresh: package bumps (including LIEF 0.17), GitHub Actions pinned to full commit SHAs, and related CI/release maintenance
  • Replaced the third-party auto-comment Action with native gh, and fixed repo context so welcome comments work without a checkout

• Bug Fixes

  • Fixed DNS-rebinding SSRF by pinning HTTPTools to safe, server-side HTTP requests
  • Hardened path traversal checks against Windows root-relative and drive-relative escapes
  • Bounded androguard in-memory ZIP member decompression to block zip-bomb extraction
  • Fixed iOS Info.plist / CFBundleExecutable path traversal when resolving bundled files
  • Fixed CSRF on dynamic analysis actions by requiring token-bearing POST (including GET-render / POST-stream for logcat)
  • Rejected inactive SAML users before ACS group updates and login
  • Fixed apktool not extracting PAK information correctly
  • Stopped mitmdump from leaking and respawning a helper process on every dynamic analysis run
  • Fixed the Maltrail malware-domain feed URL and increased the download timeout
  • Fixed responsive analysis layouts (mobile nav, report summaries) and upload/request error handling, including IntegrityError races on user creation
  • Fixed typo normnal → normal

What's Changed

• fix: typo normnal -> normal by @ayushmanchhabra in #2652
• fix!: apktool not extracting the pak informations properly by @AdrienHutinel in #2651
• Fix DNS rebinding SSRF with pinned safe HTTP requests. by @ajinabraham in #2670
• Replace wow-actions/auto-comment with native gh by @ajinabraham in #2672
• ci: fix Auto Comment gh repo context by @ajinabraham in #2674
• Harden path traversal against Windows root-relative escapes by @ajinabraham in #2673
• Bound androguard ZIP member decompression by @ajinabraham in #2675
• Reject inactive SAML users before ACS group updates by @ajinabraham in #2677
• Fix iOS plist-derived path traversal by @ajinabraham in #2678
• Fix CSRF in dynamic analysis actions by @ajinabraham in #2679
• Prepare 4.5.3 dependency release by @ajinabraham in #2680
• Update for /maltrail-malware-domains.txt link by @MikhailKasimov in #2662
• fix: mitmdump process leaked and respawned on every dynamic analysis run by @alanhasn in #2658
• Fix responsive layouts and request error handling by @ajinabraham in #2681
• feat: expose decompiled Android XML files via the view_source REST API by @alanhasn in #2659
• bump signatures by @ajinabraham in #2682
• docs: note CSRF POST and DOM XSS rules in AGENTS.md by @ajinabraham in #2684

New Contributors

• @MikhailKasimov made their first contribution in #2662
• @alanhasn made their first contribution in #2658

Full Changelog: v4.5.2...v4.5.3