jadx-ai-mcp

JADX-AI-MCP Part of Zin MCP Suite ⚡ Fully automated MCP server + JADX plugin built to communicate with LLM through MCP to analyze Android APKs using LLMs like Claude — uncover vulnerabilities, analyze APK, and reverse engineer effortlessly. ⭐ Contributors Thanks to these wonderful people for thei...

jadx

JADX jadx - Dex to Java decompiler Command-line and GUI tools for producing Java source code from Android Dex and APK files !WARNING Please note that in most cases jadx can't decompile 100% of the code, so errors will occur. Check the Troubleshooting guide for workarounds. Main features: decompil...

jadx-magic-strings

JADX Magic Strings Plugin A JADX plugin that extracts information from string constants. Features The plugin extracts and analyzes string constants from decompiled code to find: 1. Source File References : Detects references to Java/Kotlin source files .java, .kt, .kts, .scala, .groovy in string...

CVE-2022-0219

CVE-2022-0219 Jadx is vulnerable to Improper Restriction of XML External Entities CWE-611 when exporting a malicious APK file via the -e option containing a crafted AndroidManifest.xml / strings.xml to gradle. It can lead to local file disclosure when using it from the CLI. When used as a library...

CVE-2024-21633

MobSF Remote code execution via CVE-2024-21633 I have found an arbitrary file write in apktool and reported via github security advisory. I was aware that many projects were relied upon or dependent to apktool but after the publish of advisory and fix not many seem to be noticed or cared about it...

Apkatshu

Apkatshu Apkatshu its a Tool for extracting urls , emails , ip address , and interesting data from APK files Apkatshu : tool written in bash/python for extracting urls, emails, ip addresses, and interesting data from APK files. The user can choose either JADX or APKTOOL for de-compilation. USAGE ...

jadx

JADX jadx - Descompilador de Dex a Java Herramientas de línea de comandos y GUI para producir código fuente Java a partir de archivos Android Dex y APK !WARNING Tenga en cuenta que en la mayoría de los casos jadx no puede descompilar el 100% del código, por lo que se producirán errores. Consulte...

jadx-ai-mcp

JADX-AI-MCP Parte de Zin MCP Suite ⚡ Servidor MCP totalmente automatizado + plugin de JADX creado para comunicarse con LLMs a través de MCP para analizar APKs de Android usando LLMs como Claude: descubre vulnerabilidades, analiza APKs y realiza ingeniería inversa sin esfuerzo. ⭐ Contribuyentes...

jadx-magic-strings v1.0.3-dev

JADX Magic Strings Plugin A JADX plugin that extracts information from string constants. Features The plugin extracts and analyzes string constants from decompiled code to find: 1. Source File References : Detects references to Java/Kotlin source files .java, .kt, .kts, .scala, .groovy in string...

jadx v1.5.6

JADX jadx - Dex to Java decompiler Command line and GUI tools for producing Java source code from Android Dex and Apk files !WARNING Please note that in most cases jadx can't decompile all 100% of the code, so errors will occur. Check Troubleshooting guide for workarounds. Main features: decompil...

io.github.ifeng113:debug4j-core (>=0.0.1, <=0.2.3), io.github.ifeng113:debug4j-daemon (>=0.0.1, <=0.2.3) +7 more potentially affected by CVE-2026-42049 via io.github.skylot:jadx-core (>=1.5.1, <=1.5.5)

io.github.skylot:jadx-core MAVEN version =1.5.1, =0.0.1, =0.0.1, =0.0.1, =1.5.1, =1.5.1, =1.5.2, =1.5.1, =1.5.1, =1.5.1, =1.5.5 Source cves: CVE-2026-42049 Source advisory: SNYK:JAVA-IOGITHUBSKYLOT-17981031...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the process that inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization. An attacker can execute arbitrary code by...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the process that inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization. An attacker can execute arbitrary code by...

io.github.skylot:jadx-core (>=1.5.2, <=1.5.5), io.github.skylot:jadx-java-input (>=1.5.2, <=1.5.5) +5 more potentially affected by CVE-2026-54684 via io.github.skylot:jadx-zip (>=1.5.2, <=1.5.5)

io.github.skylot:jadx-zip MAVEN version =1.5.2, =1.5.2, =1.5.2, =1.5.2, =1.5.2, =1.5.2, =1.5.2, =1.5.2, =1.5.5 Source cves: CVE-2026-54684 Source advisory: SNYK:JAVA-IOGITHUBSKYLOT-17980835...

CVE-2026-54684

jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a malicious .xapk file can cause jadx to write attacker-controlled archive entry contents outside the intended XAPK plugin temporary unpack directory because XApkLoader resolves each entry name directly with tmpDir.resolvefileName after a...

CVE-2026-42049

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the...

CVE-2026-54684 jadx: XAPK archive entries with absolute paths can plant drop-in plugins and achieve code execution on the next jadx run

jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a malicious .xapk file can cause jadx to write attacker-controlled archive entry contents outside the intended XAPK plugin temporary unpack directory because XApkLoader resolves each entry name directly with tmpDir.resolvefileName after a...

CVE-2026-54684

jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a malicious .xapk file can cause jadx to write attacker-controlled archive entry contents outside the intended XAPK plugin temporary unpack directory because XApkLoader resolves each entry name directly with tmpDir.resolvefileName after a...

CVE-2026-54684 jadx: XAPK archive entries with absolute paths can plant drop-in plugins and achieve code execution on the next jadx run

jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a malicious .xapk file can cause jadx to write attacker-controlled archive entry contents outside the intended XAPK plugin temporary unpack directory because XApkLoader resolves each entry name directly with tmpDir.resolvefileName after a...

io.github.skylot:jadx-core (>=1.5.2, <=1.5.5), io.github.skylot:jadx-java-input (>=1.5.2, <=1.5.5) +5 more potentially affected by CVE-2026-54684 via io.github.skylot:jadx-zip (>=1.5.2, <=1.5.5)

io.github.skylot:jadx-zip MAVEN version =1.5.2, =1.5.2, =1.5.2, =1.5.2, =1.5.2, =1.5.2, =1.5.2, =1.5.2, =1.5.5 Source cves: CVE-2026-54684 Source advisory: MEND:CVE-2026-54684...