CVE-2026-42447: fallo de gravedad baja en skylot jadx
jadx: HTML Injection in Summary panel
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
8Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 3.6epss 0.2%
jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx-gui is affected by an HTML injection vulnerability in the Summary tab because SummaryNode.java appends arches and perArchCount values derived from .so file path components inside an APK into an HTML panel without escaping. A malicious APK with an HTML URL-encoded ZIP entry name can force rendering of arbitrary HTML, perform out-of-band requests, disclose the victim IP address, or interact with locally exposed applications. This issue is fixed in version 1.5.6.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Productos afectados
skylot · jadxCVEs relacionadas — skylot jadx
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-39259LOWJadx-gui subject to Denial of Service via Swing HTML renderingEPSS 0.3%CVE-2024-32653MEDIUMInsufficient input filtering of "package name" allows command execution in the device with shell privilegesEPSS 0.2%CVE-2026-54684HIGHjadx: XAPK archive entries with absolute paths can plant drop-in plugins and achieve code execution on the next jadx runEPSS 0.2%CVE-2026-42049HIGHjadx: RCE Via Groovy Code Injection in Gradle ExportEPSS 0.2%