jadx vulnerabilities

A vulnerability in jadx versions 1.5.2 to 1.5.5 allows writing files outside the intended temporary directory when extracting a malicious .xapk file. An attacker can place a JAR file into the plugins/dropins directory, which is loaded as a plugin on the next jadx run, enabling arbitrary code execution.

In jadx-gui prior to version 1.5.6, there is an HTML injection vulnerability in the Summary tab. This occurs because SummaryNode.java appends arches and perArchCount values from .so file paths in an APK into an HTML panel without proper escaping.

A vulnerability in jadx (versions prior to 1.5.6) allows Groovy code injection when exporting a decompiled APK as a Gradle project. An attacker can craft a malicious APK that, after decompilation and project opening by the victim, executes arbitrary code on their machine.