Read the docs
TI-2026-39505 Aliases CVE-2026-54684

jadx: XAPK archive entries with absolute paths can plant drop-in plugins and achieve code execution on the next jadx run

Priority HIGH 66CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a malicious .xapk file can cause jadx to write attacker-controlled archive entry contents outside the intended XAPK plugin temporary unpack directory because XApkLoader resolves each entry name directly with tmpDir.resolve(fileName) after a CWD-based ZIP security check. When jadx is launched from a directory that is an ancestor of the config directory, the arbitrary write can plant a JAR in plugins/dropins, and the next jadx run loads the JAR with URLClassLoader and ServiceLoader, executing attacker-controlled plugin code. This issue is fixed in version 1.5.6.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00201 10th percentileScored 2026-11-07
Fix Fixed jadx (skylot): 1.5.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
skylotjadx1.5.2 to before 1.5.61.5.6Patch availableCNA
  • jadx Vendorskylot Affected 1.5.2 to before 1.5.6 Fixed in 1.5.6 Patch available CNA

Remediation

  • Fix · CNA jadx (skylot) Fixed in 1.5.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54684

References

Other 3

  • TI-2022-18635 Jadx-gui subject to Denial of Service via Swing HTML rendering CVSS 3.1MEDIUM 5.5
  • TI-2026-30736 jadx: HTML Injection in Summary panel CVSS 3.1MEDIUM 5.0
  • TI-2026-30428 jadx: RCE Via Groovy Code Injection in Gradle Export CVSS 4.0HIGH 8.4
  • TI-2024-21535 Insufficient input filtering of "package name" allows command execution in the device with shell privileges CVSS 3.1MEDIUM 6.1
  • TI-2022-00156 Improper Restriction of XML External Entity Reference in skylot/jadx CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences