CVE-2026-42447
LowCVSS 3.6Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In jadx-gui prior to version 1.5.6, there is an HTML injection vulnerability in the Summary tab. This occurs because SummaryNode.java appends arches and perArchCount values from .so file paths in an APK into an HTML panel without proper escaping.
Risk Assessment
A malicious APK can force arbitrary HTML rendering, perform out-of-band requests, disclose the victim's IP address, or interact with locally exposed applications, posing a risk to confidentiality and network security.
Recommendation
Immediately update jadx to version 1.5.6 or later, which includes a fix for the HTML injection vulnerability.
Original NVD description (English source)
jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx-gui is affected by an HTML injection vulnerability in the Summary tab because SummaryNode.java appends arches and perArchCount values derived from .so file path components inside an APK into an HTML panel without escaping. A malicious APK with an HTML URL-encoded ZIP entry name can force rendering of arbitrary HTML, perform out-of-band requests, disclose the victim IP address, or interact with locally exposed applications. This issue is fixed in version 1.5.6.