Threat Intelligence Database

jadx versions from 1.5.2 up to but not including 1.5.6 contain a path traversal vulnerability. A malicious .xapk file can cause jadx to write files outside the intended temporary directory, potentially planting a malicious JAR plugin. This plugin can then be loaded and executed on the next run of jadx, leading to arbitrary code execution. The issue is fixed in version 1.5.6.

jadx, a Dex to Java decompiler, has an HTML injection vulnerability in its GUI Summary tab in versions prior to 1.5.6. This occurs because unescaped data derived from APK file paths is inserted into an HTML panel, allowing a malicious APK to inject arbitrary HTML. The vulnerability can lead to out-of-band requests, IP address disclosure, or interaction with local applications. The issue is fixed in version 1.5.6.

jadx, a Dex to Java decompiler, prior to version 1.5.6, improperly sanitizes the android:versionName value from an AndroidManifest when exporting a decompiled APK as an Android Gradle project. This allows a malicious APK to inject Groovy code into the generated build.gradle file, which can be executed when opening or building the project. The vulnerability is fixed in version 1.5.6.