CVE-2024-32653: falha de média gravidade em skylot jadx
Insufficient input filtering of "package name" allows command execution in the device with shell privileges
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.1epss 0.2%
jadx is a Dex to Java decompiler. Prior to version 1.5.0, the package name is not filtered before concatenation. This can be exploited to inject arbitrary code into the package name. The vulnerability allows an attacker to execute commands with shell privileges. Version 1.5.0 contains a patch for the vulnerability.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H
Produtos afetados
skylot · jadxCVEs relacionadas — skylot jadx
No mesmo produto, das mais perigosas para as menos.
CVE-2022-39259LOWJadx-gui subject to Denial of Service via Swing HTML renderingEPSS 0.3%CVE-2026-42447LOWjadx: HTML Injection in Summary panelEPSS 0.2%CVE-2026-54684HIGHjadx: XAPK archive entries with absolute paths can plant drop-in plugins and achieve code execution on the next jadx runEPSS 0.2%CVE-2026-42049HIGHjadx: RCE Via Groovy Code Injection in Gradle ExportEPSS 0.2%