jadx: RCE Via Groovy Code Injection in Gradle Export
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.
Summary
jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the string context so that opening or building the exported Gradle project executes attacker-controlled Groovy code on the victim machine. This issue is fixed in version 1.5.6.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA jadx (skylot) Fixed in 1.5.6
Timeline
- 2026-10-02 Threatist record created from CVE-2026-42049
References
More skylot vulnerabilities
- TI-2026-39505 jadx: XAPK archive entries with absolute paths can plant drop-in plugins and achieve code execution on the next jadx run CVSS 3.1HIGH 7.0
- TI-2022-18635 Jadx-gui subject to Denial of Service via Swing HTML rendering CVSS 3.1MEDIUM 5.5
- TI-2026-30736 jadx: HTML Injection in Summary panel CVSS 3.1MEDIUM 5.0
- TI-2024-21535 Insufficient input filtering of "package name" allows command execution in the device with shell privileges CVSS 3.1MEDIUM 6.1
- TI-2022-00156 Improper Restriction of XML External Entity Reference in skylot/jadx CVSS 3.1MEDIUM 5.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences