Insufficient input filtering of "package name" allows command execution in the device with shell privileges
Priority LOW 29CWE-20Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
jadx is a Dex to Java decompiler. Prior to version 1.5.0, the package name is not filtered before concatenation. This can be exploited to inject arbitrary code into the package name. The vulnerability allows an attacker to execute commands with shell privileges. Version 1.5.0 contains a patch for the vulnerability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00236 14th percentileScored 2026-11-07
Fix Fixed jadx (skylot): 1.5.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| skylot | jadx | before 1.5.0 | 1.5.0 | Patch available | CNA |
- jadx Vendorskylot Affected before 1.5.0 Fixed in 1.5.0 Patch available CNA
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:skylot:jadx:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:skylot:jadx:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
- Fix · CNA jadx (skylot) Fixed in 1.5.0
Timeline
- 2026-10-02 Threatist record created from CVE-2024-32653
References
More skylot vulnerabilities
- TI-2026-39505 jadx: XAPK archive entries with absolute paths can plant drop-in plugins and achieve code execution on the next jadx run CVSS 3.1HIGH 7.0
- TI-2022-18635 Jadx-gui subject to Denial of Service via Swing HTML rendering CVSS 3.1MEDIUM 5.5
- TI-2026-30736 jadx: HTML Injection in Summary panel CVSS 3.1MEDIUM 5.0
- TI-2026-30428 jadx: RCE Via Groovy Code Injection in Gradle Export CVSS 4.0HIGH 8.4
- TI-2022-00156 Improper Restriction of XML External Entity Reference in skylot/jadx CVSS 3.1MEDIUM 5.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences