Jadx
Monthly
HTML injection in jadx-gui prior to version 1.5.6 enables a malicious APK to force arbitrary HTML rendering inside the Summary tab, allowing out-of-band network requests that disclose the analyst's IP address or interact with locally exposed services. The injection point is SummaryNode.java, which inserts attacker-controlled .so file path components from APK ZIP entries directly into an HTML panel without escaping. Publicly available exploit code exists per SSVC assessment, though the attack is non-automatable and constrained to interactive local use, consistent with the low CVSS score of 3.6 and an EPSS probability of just 0.14%.
jadx is a set of command line and GUI tools for producing Java source code from Android Dex and Apk files. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
HTML injection in jadx-gui prior to version 1.5.6 enables a malicious APK to force arbitrary HTML rendering inside the Summary tab, allowing out-of-band network requests that disclose the analyst's IP address or interact with locally exposed services. The injection point is SummaryNode.java, which inserts attacker-controlled .so file path components from APK ZIP entries directly into an HTML panel without escaping. Publicly available exploit code exists per SSVC assessment, though the attack is non-automatable and constrained to interactive local use, consistent with the low CVSS score of 3.6 and an EPSS probability of just 0.14%.
jadx is a set of command line and GUI tools for producing Java source code from Android Dex and Apk files. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.