v4.4.1

v4.4.1 Changelog

• Features or Enhancements

  • Frida 17+ support and script updates
  • Breaking change: Corellium iOS device must install Frida server version >=17
  • Updated Frida scripts for logging, ssl/cert pinning bypass
  • Added bridges support to frida
  • Dependency updates
  • Apply MobSF proxy settings to standalone tools_download.py
  • Strict user email validation
  • Updated CodeQL action

• Security

  • Zip bomb Denial of Service (DoS) via Resource Exhaustion (Disk Space)
  • Stored Cross Site Scripting (XSS) via malicious SVG app icon
  • Arbitrary File Write (AR-Slip) via Absolute Path in .a Extraction
  • Path Traversal in GET /download/ using absolute filenames in MobSF data directory

• Bug Fixes

  • Bug fix in CVSS calculation
  • Typo fixes
  • Fix Frida Code Editor code alignment issues
  • Fix Google Play Scrapper timeout issues behind proxy
  • Correctly resolve executable path in .app bundles during iOS IPA SCA

What's Changed

• Fix misspelling of the word unpatched by @jpierson-at-riis in #2515
• Correct CVSS calculation by accessing findings key properly by @lorakste in #2511
• v4.3.3 Security Updates by @ajinabraham in #2518
• June 22nd 2025 updates by @ajinabraham in #2530
• fix(ios_analyzer): Correctly resolve executable path in .app bundles by @cpuu in #2533
• [Security] Fix Vulnerabilities Aug 2025 MobSF v4.4.1 by @ajinabraham in #2545

New Contributors

• @jpierson-at-riis made their first contribution in #2515
• @lorakste made their first contribution in #2511

Full Changelog: v4.3.2...v4.4.1