The vulnerability in jadx (CVE-2026-54684) is a path traversal flaw (CWE-22) affecting versions 1.5.2 through 1.5.5. It arises because the XApkLoader resolves archive entry names directly with tmpDir.resolve(fileName) after a current working directory-based ZIP security check, allowing a malicious .xapk file to write attacker-controlled contents outside the intended temporary unpack directory. If jadx is launched from a directory that is an ancestor of the config directory, this arbitrary write can place a malicious JAR file into plugins/dropins. On the next execution, jadx loads this JAR via URLClassLoader and ServiceLoader, resulting in execution of attacker-controlled plugin code. The vulnerability is addressed in version 1.5.6.

Successful exploitation allows an attacker to execute arbitrary code within the context of jadx by planting a malicious plugin JAR file. This can lead to full compromise of the application environment, including confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:H/I:H/A:H).

Upgrade jadx to version 1.5.6 or later, where this vulnerability is fixed. There is no official vendor advisory provided here, but the description explicitly states the issue is resolved in 1.5.6. Until upgrade, avoid opening untrusted .xapk files with affected versions.