CVE-2026-42049

Deferred Deferred - Pending Action

Code Injection in Jadx Dex to Java Decompiler

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the string context so that opening or building the exported Gradle project executes attacker-controlled Groovy code on the victim machine. This issue is fixed in version 1.5.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-42049

Affected Vendors & Products

Vendor	Product	Version / Range
skylot	jadx	1.5.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

jadx before 1.5.6 inserts the android:versionName from an AndroidManifest into the generated app/build.gradle Groovy template without sanitization when exporting a decompiled APK as an Android Gradle project. This allows a malicious APK to inject Groovy code that executes on the victim machine when the project is opened or built.

Detection Guidance

This vulnerability can be detected by checking the version of jadx installed. If you are using a version prior to 1.5.6, your system is vulnerable. Run 'jadx --version' to check the installed version.

Impact Analysis

If you decompile an APK containing malicious android:versionName and export it as a Gradle project, opening or building the project could execute attacker-controlled code on your machine. This could lead to data theft, system compromise, or further attacks.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially causing data breaches or loss of sensitive information. Such incidents may violate GDPR or HIPAA requirements for data protection and could result in regulatory penalties or legal consequences.

Mitigation Strategies

Upgrade jadx to version 1.5.6 or later. This version includes the fix for the improper sanitization issue. Download the latest version from the official jadx repository or package manager.

Hi! I’m here to help you understand CVE-2026-42049. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70