All 5 CVE vulnerabilities found in jadx, with AI-generated Chinese analysis, references, and POCs.
Vendor: skylot
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-54684 | jadx: XAPK archive entries with absolute paths can plant drop-in plugins and achieve code execution on the next jadx run CWE-22 | 7.0 | High | 2026-07-14 |
| CVE-2026-42447 | jadx: HTML Injection in Summary panel CWE-79 | 3.6 | Low | 2026-07-14 |
| CVE-2026-42049 | jadx: RCE Via Groovy Code Injection in Gradle Export CWE-94 | - | - | 2026-07-14 |
| CVE-2024-32653 | Insufficient input filtering of "package name" allows command execution in the device with shell privileges CWE-20 | 6.1 | Medium | 2024-04-22 |
| CVE-2022-39259 | Jadx-gui subject to Denial of Service via Swing HTML rendering CWE-20 | 3.3 | Low | 2022-10-21 |
All 5 known CVE vulnerabilities affecting jadx with full Chinese analysis, references, and POCs where available.