Threat Intelligence Database

jadx versions from 1.5.2 up to but not including 1.5.6 contain a path traversal vulnerability. A malicious .xapk file can cause jadx to write files outside the intended temporary directory, potentially planting a malicious JAR plugin. This plugin is then loaded and executed on the next run of jadx, leading to arbitrary code execution. The issue is fixed in version 1.5.6.

jadx is a Dex to Java decompiler with a cross-site scripting (XSS) vulnerability in the jadx-gui Summary tab prior to version 1.5.6. The vulnerability arises because unescaped values derived from APK file path components are appended into an HTML panel, allowing a malicious APK to inject arbitrary HTML. This can lead to out-of-band requests, IP address disclosure, or interaction with local applications. The issue is fixed in version 1.5.6.

jadx versions prior to 1.5.6 improperly handle the android:versionName value from AndroidManifest when exporting a decompiled APK as an Android Gradle project. This lack of sanitization allows malicious APKs to inject Groovy code into the generated build.gradle template, potentially executing attacker-controlled code on the victim's machine. The issue is fixed in version 1.5.6.