jadx vulnerabilities

2 known vulnerabilities in jadx from Skylot. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.0 High severity

  jadx: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-54684Jul 14, 2026Skylot

  jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a malicious .xapk file can cause jadx to write attacker-controlled archive entry contents outside the intended XAPK plugin temporary unpack directory because XApkLoader resolves each entry name directly wi

• 8.4 High severity

  jadx: Improper Control of Generation of Code

  CVE-2026-42049Jul 14, 2026Skylot

  jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A