CVE-2026-42447

Awaiting Analysis Awaiting Analysis - Queue

HTML Injection in jadx-gui via Malicious APK

Publication date: 2026-07-14

Last updated on: 2026-07-30

Assigner: GitHub, Inc.

Description

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx-gui is affected by an HTML injection vulnerability in the Summary tab because SummaryNode.java appends arches and perArchCount values derived from .so file path components inside an APK into an HTML panel without escaping. A malicious APK with an HTML URL-encoded ZIP entry name can force rendering of arbitrary HTML, perform out-of-band requests, disclose the victim IP address, or interact with locally exposed applications. This issue is fixed in version 1.5.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-30

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-42447

Affected Vendors & Products

Vendor	Product	Version / Range
jadx_project	jadx	to 1.5.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

jadx-gui before 1.5.6 has an HTML injection flaw in the Summary tab. It allows malicious APKs with crafted .so file paths to inject HTML into the SummaryNode.java panel without proper escaping. This can lead to arbitrary HTML rendering and potential out-of-band requests.

Detection Guidance

This vulnerability is specific to jadx-gui versions before 1.5.6 and involves HTML injection via malicious APK files. Detection requires checking the installed jadx version and inspecting APK files for suspicious ZIP entry names containing HTML or URL-encoded paths.

Impact Analysis

An attacker could trick you into opening a malicious APK in jadx-gui. This could expose your IP address, trigger requests to external sites, or interact with locally running applications through the injected HTML.

Compliance Impact

This vulnerability could lead to data exposure or unauthorized interactions, potentially violating GDPR (privacy) or HIPAA (health data) by leaking sensitive information or enabling unauthorized access.

Mitigation Strategies

Upgrade jadx to version 1.5.6 or later. Avoid opening untrusted APK files in jadx-gui. If using older versions, disable the Summary tab in jadx-gui to prevent HTML rendering.

Hi! I’m here to help you understand CVE-2026-42447. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70