CVE-2026-42447
LowCVSS 3.6Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In jadx-gui prior to version 1.5.6, there is an HTML injection vulnerability in the Summary tab. This occurs because SummaryNode.java appends arches and perArchCount values from .so file paths in an APK into an HTML panel without proper escaping.
Risk Assessment
A malicious APK can force arbitrary HTML rendering, perform out-of-band requests, disclose the victim's IP address, or interact with locally exposed applications, posing a risk to confidentiality and network security.
Recommendation
Immediately update jadx to version 1.5.6 or later, which includes a fix for the HTML injection vulnerability.
Other vulnerabilities in jadx
See all- CVE-2026-54684High
A vulnerability in jadx versions 1.5.2 to 1.5.5 allows writing files outside the intended temporary directory when extracting a malicious .xapk file. An attacker can place a JAR file into the plugins/dropins directory, which is loaded as a plugin on the next jadx run, enabling arbitrary code execution.
- CVE-2026-42049High
A vulnerability in jadx (versions prior to 1.5.6) allows Groovy code injection when exporting a decompiled APK as a Gradle project. An attacker can craft a malicious APK that, after decompilation and project opening by the victim, executes arbitrary code on their machine.
Original NVD description (English source)
jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx-gui is affected by an HTML injection vulnerability in the Summary tab because SummaryNode.java appends arches and perArchCount values derived from .so file path components inside an APK into an HTML panel without escaping. A malicious APK with an HTML URL-encoded ZIP entry name can force rendering of arbitrary HTML, perform out-of-band requests, disclose the victim IP address, or interact with locally exposed applications. This issue is fixed in version 1.5.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS