59 matches found
CVE-2022-0219
CVE-2022-0219 Jadx è vulnerabile alla Restrizione Impropria delle Entità Esterne XML CWE-611 quando esporta un file APK malevolo tramite l'opzione -e contenente un AndroidManifest.xml / strings.xml manipolato in gradle. Può portare alla divulgazione di file locali quando viene usato dalla CLI...
CVE-2024-21633
MobSF Remote-Codeausführung via CVE-2024-21633 Ich habe einen beliebigen Dateischreibvorgang in apktool gefunden und über GitHub Security Advisory gemeldet. Mir war bewusst, dass viele Projekte auf apktool angewiesen oder davon abhängig waren, aber nach der Veröffentlichung des Advisories und dem...
Apkatshu
Apkatshu Apkatshu è uno strumento per estrarre URL, email, indirizzi IP e dati interessanti da file APK root@kitploit: Apkatshu : tool written in bash/python for extracting urls, emails, ip addresses, and interesting data from APK files. The user can choose either JADX or APKTOOL for...
jadx
JADX jadx - Decompilatore Dex in Java Strumenti da riga di comando e GUI per produrre codice sorgente Java da file Android Dex e Apk !WARNING Si prega di notare che nella maggior parte dei casi jadx non può decompilare il 100% del codice, quindi si verificheranno errori. Consulta la guida alla...
jadx-ai-mcp
JADX-AI-MCP Partie de Zin MCP Suite ⚡ Serveur MCP entièrement automatisé + plugin JADX conçu pour communiquer avec les LLM via MCP afin d'analyser des APK Android avec des LLM comme Claude — découvrez des vulnérabilités, analysez des APK et faites de la rétro-ingénierie sans effort. ⭐ Contributeu...
jadx
JADX jadx - Dex to Java decompiler Command line and GUI tools for producing Java source code from Android Dex and Apk files !WARNING Please note that in most cases jadx can't decompile all 100% of the code, so errors will occur. Check Troubleshooting guide for workarounds. Main features: decompil...
jadx-magic-strings
JADX मैजिक स्ट्रिंग्स प्लगइन एक JADX प्लगइन जो स्ट्रिंग स्थिरांक से जानकारी निकालता है। विशेषताएँ प्लगइन डीकंपाइल कोड से स्ट्रिंग स्थिरांक निकालता और विश्लेषण करता है ताकि खोजा जा सके: 1. स्रोत फ़ाइल संदर्भ : स्ट्रिंग स्थिरांक में Java/Kotlin स्रोत फ़ाइलों .java, .kt, .kts, .scala, .groovy के...
CVE-2026-54684
jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a malicious .xapk file can cause jadx to write attacker-controlled archive entry contents outside the intended XAPK plugin temporary unpack directory because XApkLoader resolves each entry name directly with tmpDir.resolvefileName after a...
CVE-2026-42049
jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the...
CVE-2026-54684
CVE-2026-54684 — jadx (Dex to Java decompiler) Affected versions: 1.5.2 to 1.5.5. The vulnerability arises when processing a malicious .xapk file: XApkLoader resolves each entry name directly with tmpDir.resolve(fileName) after a CWD-based ZIP security check, allowing an attacker to write archive...
CVE-2026-54684 jadx: XAPK archive entries with absolute paths can plant drop-in plugins and achieve code execution on the next jadx run
jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a malicious .xapk file can cause jadx to write attacker-controlled archive entry contents outside the intended XAPK plugin temporary unpack directory because XApkLoader resolves each entry name directly with tmpDir.resolvefileName after a...
CVE-2026-54684 jadx: XAPK archive entries with absolute paths can plant drop-in plugins and achieve code execution on the next jadx run
jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a malicious .xapk file can cause jadx to write attacker-controlled archive entry contents outside the intended XAPK plugin temporary unpack directory because XApkLoader resolves each entry name directly with tmpDir.resolvefileName after a...
CVE-2026-42447 jadx: HTML Injection in Summary panel
jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx-gui is affected by an HTML injection vulnerability in the Summary tab because SummaryNode.java appends arches and perArchCount values derived from .so file path components inside an APK into an HTML panel without escaping. A malicious APK wit...
CVE-2026-42447 jadx: HTML Injection in Summary panel
jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx-gui is affected by an HTML injection vulnerability in the Summary tab because SummaryNode.java appends arches and perArchCount values derived from .so file path components inside an APK into an HTML panel without escaping. A malicious APK wit...
CVE-2026-42447
CVE-2026-42447 affects jadx, the Dex-to-Java decompiler. Prior to 1.5.6, jadx-gui’s Summary tab is vulnerable to HTML injection because SummaryNode.java appends arches and perArchCount values derived from APK .so path components into an HTML panel without escaping. A malicious APK with a HTML URL...
CVE-2026-42049 jadx: RCE Via Groovy Code Injection in Gradle Export
jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the...
CVE-2026-42049 jadx: RCE Via Groovy Code Injection in Gradle Export
jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the...
CVE-2026-42049
CVE-2026-42049 affects jadx (Dex to Java decompiler). Before 1.5.6, exporting a decompiled APK as an Android Gradle project could cause the android:versionName from the manifest to be inserted into the generated app/build.gradle Groovy template without proper sanitization, enabling opening or bui...
PT-2026-58858
Name of the Vulnerable Software and Affected Versions jadx versions 1.5.2 through 1.5.5 Description A path traversal issue exists where a malicious .xapk file can cause the application to write attacker-controlled archive entry contents outside the intended XAPK plugin temporary unpack directory...
