CVE-2022-39259

The CVE refers to Skylot Jadx (Jadx-gui) prior to version 1.4.5, where opening a ZIP containing an HTML sequence can trigger a Denial of Service in the Swing HTML rendering. The underlying issue is a GUI-side DoS vulnerability in Jadx-gui’s HTML rendering path. The vulnerability is patched in ver...

CVE-2022-0219

CVE-2022-0219 concerns skylot/jadx prior to 1.3.2, where improper restriction of XML external entity references enables a local disclosure scenario. The issue is triggered when a user exports a crafted APK (via the -e option) containing manipulated XML (AndroidManifest.xml/strings.xml) to Gradle,...

CVE-2026-42447

CVE-2026-42447 affects jadx, the Dex-to-Java decompiler. Prior to 1.5.6, jadx-gui’s Summary tab is vulnerable to HTML injection because SummaryNode.java appends arches and perArchCount values derived from APK .so path components into an HTML panel without escaping. A malicious APK with a HTML URL...