CVE-2026-54684
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A vulnerability in jadx versions 1.5.2 to 1.5.5 allows writing files outside the intended temporary directory when extracting a malicious .xapk file. An attacker can place a JAR file into the plugins/dropins directory, which is loaded as a plugin on the next jadx run, enabling arbitrary code execution.
Risk Assessment
The organization risks full compromise of the jadx process and execution of malicious code in the user's context. This could lead to data theft, privilege escalation, or lateral movement within the IT environment.
Recommendation
Upgrade jadx to version 1.5.6 or later immediately. Until then, avoid opening .xapk files from untrusted sources and do not run jadx from directories that are ancestors of the config directory.
Other vulnerabilities in jadx
See all- CVE-2026-42447Low
In jadx-gui prior to version 1.5.6, there is an HTML injection vulnerability in the Summary tab. This occurs because SummaryNode.java appends arches and perArchCount values from .so file paths in an APK into an HTML panel without proper escaping.
- CVE-2026-42049High
A vulnerability in jadx (versions prior to 1.5.6) allows Groovy code injection when exporting a decompiled APK as a Gradle project. An attacker can craft a malicious APK that, after decompilation and project opening by the victim, executes arbitrary code on their machine.
Original NVD description (English source)
jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a malicious .xapk file can cause jadx to write attacker-controlled archive entry contents outside the intended XAPK plugin temporary unpack directory because XApkLoader resolves each entry name directly with tmpDir.resolve(fileName) after a CWD-based ZIP security check. When jadx is launched from a directory that is an ancestor of the config directory, the arbitrary write can plant a JAR in plugins/dropins, and the next jadx run loads the JAR with URLClassLoader and ServiceLoader, executing attacker-controlled plugin code. This issue is fixed in version 1.5.6.