jadx-magic-strings

JADX Magic Strings Plugin A JADX plugin that extracts information from string constants. Features The plugin extracts and analyzes string constants from decompiled code to find: 1. Source File References : Detects references to Java/Kotlin source files .java, .kt, .kts, .scala, .groovy in string...

Apkatshu

Apkatshu Apkatshu es una herramienta para extraer URLs, correos electrónicos, direcciones IP y datos interesantes de archivos APK. root@kitploit: Apkatshu : tool written in bash/python for extracting urls, emails, ip addresses, and interesting data from APK files. The user can choose either JADX ...

jadx

JADX jadx - Dex to Java decompiler Command line and GUI tools for producing Java source code from Android Dex and Apk files !WARNING Please note that in most cases jadx can't decompile all 100% of the code, so errors will occur. Check Troubleshooting guide for workarounds. Main features: decompil...

jadx

JADX jadx - Descompilador de Dex a Java Herramientas de línea de comandos y GUI para generar código fuente Java a partir de archivos Android Dex y Apk !WARNING Tenga en cuenta que en la mayoría de los casos jadx no puede descompilar el 100% del código, por lo que se producirán errores. Consulte l...

jadx-ai-mcp

JADX-AI-MCP Part of Zin MCP Suite ⚡ Fully automated MCP server + JADX plugin built to communicate with LLM through MCP to analyze Android APKs using LLMs like Claude — uncover vulnerabilities, analyze APK, and reverse engineer effortlessly. ⭐ Contributors Thanks to these wonderful people for thei...

jadx-ai-mcp

JADX-AI-MCP Parte de Zin MCP Suite ⚡ Servidor MCP totalmente automatizado + plugin de JADX creado para comunicarse con LLMs a través de MCP para analizar APKs de Android usando LLMs como Claude: descubre vulnerabilidades, analiza APKs y realiza ingeniería inversa sin esfuerzo. ⭐ Contribuyentes...

CVE-2024-21633

MobSF Remote code execution via CVE-2024-21633 I have found an arbitrary file write in apktool and reported via github security advisory. I was aware that many projects were relied upon or dependent to apktool but after the publish of advisory and fix not many seem to be noticed or cared about it...

CVE-2022-0219

CVE-2022-0219 Jadx is vulnerable to Improper Restriction of XML External Entities CWE-611 when exporting a malicious APK file via the -e option containing a crafted AndroidManifest.xml / strings.xml to gradle. It can lead to local file disclosure when using it from the CLI. When used as a library...

CVE-2026-54684

jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a malicious .xapk file can cause jadx to write attacker-controlled archive entry contents outside the intended XAPK plugin temporary unpack directory because XApkLoader resolves each entry name directly with tmpDir.resolvefileName after a...

CVE-2026-42049

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the...

CVE-2026-54684

CVE-2026-54684 — jadx (Dex to Java decompiler) Affected versions: 1.5.2 to 1.5.5. The vulnerability arises when processing a malicious .xapk file: XApkLoader resolves each entry name directly with tmpDir.resolve(fileName) after a CWD-based ZIP security check, allowing an attacker to write archive...

CVE-2026-54684 jadx: XAPK archive entries with absolute paths can plant drop-in plugins and achieve code execution on the next jadx run

jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a malicious .xapk file can cause jadx to write attacker-controlled archive entry contents outside the intended XAPK plugin temporary unpack directory because XApkLoader resolves each entry name directly with tmpDir.resolvefileName after a...

CVE-2026-54684 jadx: XAPK archive entries with absolute paths can plant drop-in plugins and achieve code execution on the next jadx run

jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a malicious .xapk file can cause jadx to write attacker-controlled archive entry contents outside the intended XAPK plugin temporary unpack directory because XApkLoader resolves each entry name directly with tmpDir.resolvefileName after a...

CVE-2026-42447 jadx: HTML Injection in Summary panel

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx-gui is affected by an HTML injection vulnerability in the Summary tab because SummaryNode.java appends arches and perArchCount values derived from .so file path components inside an APK into an HTML panel without escaping. A malicious APK wit...

CVE-2026-42447 jadx: HTML Injection in Summary panel

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx-gui is affected by an HTML injection vulnerability in the Summary tab because SummaryNode.java appends arches and perArchCount values derived from .so file path components inside an APK into an HTML panel without escaping. A malicious APK wit...

CVE-2026-42447

CVE-2026-42447 affects jadx, the Dex-to-Java decompiler. Prior to 1.5.6, jadx-gui’s Summary tab is vulnerable to HTML injection because SummaryNode.java appends arches and perArchCount values derived from APK .so path components into an HTML panel without escaping. A malicious APK with a HTML URL...

CVE-2026-42049 jadx: RCE Via Groovy Code Injection in Gradle Export

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the...

CVE-2026-42049 jadx: RCE Via Groovy Code Injection in Gradle Export

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the...

CVE-2026-42049

CVE-2026-42049 affects jadx (Dex to Java decompiler). Before 1.5.6, exporting a decompiled APK as an Android Gradle project could cause the android:versionName from the manifest to be inserted into the generated app/build.gradle Groovy template without proper sanitization, enabling opening or bui...

PT-2026-58858

Name of the Vulnerable Software and Affected Versions jadx versions 1.5.2 through 1.5.5 Description A path traversal issue exists where a malicious .xapk file can cause the application to write attacker-controlled archive entry contents outside the intended XAPK plugin temporary unpack directory...