CVE-2026-42447: falha de baixa gravidade em skylot jadx
jadx: HTML Injection in Summary panel
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 3.6epss 0.2%
jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx-gui is affected by an HTML injection vulnerability in the Summary tab because SummaryNode.java appends arches and perArchCount values derived from .so file path components inside an APK into an HTML panel without escaping. A malicious APK with an HTML URL-encoded ZIP entry name can force rendering of arbitrary HTML, perform out-of-band requests, disclose the victim IP address, or interact with locally exposed applications. This issue is fixed in version 1.5.6.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Produtos afetados
skylot · jadxCVEs relacionadas — skylot jadx
No mesmo produto, das mais perigosas para as menos.
CVE-2022-39259LOWJadx-gui subject to Denial of Service via Swing HTML renderingEPSS 0.3%CVE-2024-32653MEDIUMInsufficient input filtering of "package name" allows command execution in the device with shell privilegesEPSS 0.2%CVE-2026-54684HIGHjadx: XAPK archive entries with absolute paths can plant drop-in plugins and achieve code execution on the next jadx runEPSS 0.2%CVE-2026-42049HIGHjadx: RCE Via Groovy Code Injection in Gradle ExportEPSS 0.2%