Vulnerabilities

TI-2026-39505 CVE-2026-54684

jadx: XAPK archive entries with absolute paths can plant drop-in plugins and achieve code execution on the next jadx run

HIGH 66

jadx is a Dex to Java decompiler.

CVSS 3.1HIGH 7.0 Local No auth User interaction EPSS 0.00201 Published 2026-07-14 Fixed in 1.5.6 CWE-22

TI-2026-30736 CVE-2026-42447

MEDIUM 56

jadx is a Dex to Java decompiler.

CVSS 3.1MEDIUM 5.0 Local No auth User interaction EPSS 0.00224 Published 2026-07-14 Fixed in 1.5.6 CWE-79

TI-2026-30428 CVE-2026-42049

LOW 38

jadx is a Dex to Java decompiler.

CVSS 4.0HIGH 8.4 Local No auth User interaction EPSS 0.00197 Published 2026-07-14 Fixed in 1.5.6 CWE-94

TI-2024-21535 CVE-2024-32653

LOW 29

jadx is a Dex to Java decompiler.

CVSS 3.1MEDIUM 6.1 Local Low privileges User interaction EPSS 0.00236 Published 2024-04-22 Fixed in 1.5.0 CWE-20

TI-2022-18635 CVE-2022-39259 · GHSA-3r7j-8mqh-6qhx

MEDIUM 58

jadx is a set of command line and GUI tools for producing Java source code from Android Dex and Apk files.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.0033 Published 2022-10-21 Fixed in 1.4.5 CWE-20

TI-2022-00156 CVE-2022-0219 · GHSA-r8j4-96mx-rjcc

LOW 27

Improper Restriction of XML External Entity Reference in GitHub repository skylot/jadx prior to 1.3.2.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.01054 Published 2022-01-20 Fixed in 1.3.2 CWE-611