EUVD-2026-44535Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Local vector because victim must manually open the APK in a desktop GUI; scope change justified by out-of-band exfiltration beyond jadx process; no integrity or availability impact from HTML injection alone.
Primary rating from Vendor (github).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx-gui is affected by an HTML injection vulnerability in the Summary tab because SummaryNode.java appends arches and perArchCount values derived from .so file path components inside an APK into an HTML panel without escaping. A malicious APK with an HTML URL-encoded ZIP entry name can force rendering of arbitrary HTML, perform out-of-band requests, disclose the victim IP address, or interact with locally exposed applications. This issue is fixed in version 1.5.6.
AnalysisAI
HTML injection in jadx-gui prior to version 1.5.6 enables a malicious APK to force arbitrary HTML rendering inside the Summary tab, allowing out-of-band network requests that disclose the analyst's IP address or interact with locally exposed services. The injection point is SummaryNode.java, which inserts attacker-controlled .so file path components from APK ZIP entries directly into an HTML panel without escaping. Publicly available exploit code exists per SSVC assessment, though the attack is non-automatable and constrained to interactive local use, consistent with the low CVSS score of 3.6 and an EPSS probability of just 0.14%.
Technical ContextAI
jadx is an open-source DEX-to-Java decompiler; its GUI component (jadx-gui) displays a Summary tab built by the SummaryNode.java class using a custom StringEscapeUtils.Builder. The vulnerable code called builder.append() - which inserts raw strings into HTML context - rather than builder.escape() when embedding the arch and perArchCount values derived from .so native library ZIP entry paths inside an APK (Android Package, a ZIP archive). Because APK file entry names are fully attacker-controlled, a crafted path component containing URL-encoded HTML such as an image tag with an onerror handler is directly interpolated into the rendered HTML panel. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the confirmed root cause. The commit diff at 7713655feeb8e1c4b80797e8fc0e8eb1550b65ef confirms two specific unescaped sink sites: the architecture list line and the per-arch count line, both in addNativeLibsInfo(), now remediated by replacing append() with escape() calls.
RemediationAI
Upgrade jadx to version 1.5.6 or later, the confirmed fixed release available at https://github.com/skylot/jadx/releases/tag/v1.5.6; the precise fix is commit 7713655feeb8e1c4b80797e8fc0e8eb1550b65ef, which replaces builder.append() with builder.escape() for arch and perArchCount values in SummaryNode.java. If immediate upgrade is not possible, analysts can avoid navigating to the Summary tab when examining APKs from untrusted sources, eliminating the rendering trigger entirely with no impact on decompilation workflows that rely only on source view and search features. Network-level egress filtering on analyst workstations reduces the out-of-band IP exfiltration risk but does not prevent HTML rendering or block interaction with services bound to the loopback interface, so it is an incomplete compensating control. Blocking outbound requests at the host firewall level for the jadx process specifically provides stronger containment of the exfiltration channel.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today