CVE-2026-42049
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A vulnerability in jadx (versions prior to 1.5.6) allows Groovy code injection when exporting a decompiled APK as a Gradle project. An attacker can craft a malicious APK that, after decompilation and project opening by the victim, executes arbitrary code on their machine.
Risk Assessment
The organization is at risk of remote code execution (RCE) on the workstation of an analyst or developer who opens or builds the exported Gradle project. This could lead to system compromise, data theft, or further propagation of the attack within the internal network.
Recommendation
Immediately update jadx to version 1.5.6 or later. Before opening exported Gradle projects from untrusted sources, manually review them for suspicious code fragments.
Other vulnerabilities in jadx
See all- CVE-2026-54684High
A vulnerability in jadx versions 1.5.2 to 1.5.5 allows writing files outside the intended temporary directory when extracting a malicious .xapk file. An attacker can place a JAR file into the plugins/dropins directory, which is loaded as a plugin on the next jadx run, enabling arbitrary code execution.
- CVE-2026-42447Low
In jadx-gui prior to version 1.5.6, there is an HTML injection vulnerability in the Summary tab. This occurs because SummaryNode.java appends arches and perArchCount values from .so file paths in an APK into an HTML panel without proper escaping.
Original NVD description (English source)
jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the string context so that opening or building the exported Gradle project executes attacker-controlled Groovy code on the victim machine. This issue is fixed in version 1.5.6.