CVE-2026-42049 skylot CVE debrief

Who should care

Developers and users of jadx, especially those handling Android APKs, should assess exposure and apply patches to prevent code execution via malicious APKs. This includes reviewing affected versions, applying patches, and verifying fixes. Security teams and operators should also review compensating controls and monitor for potential exposure.

Why it matters

CVE-2026-42049 allows code execution via malicious APKs in jadx versions prior to 1.5.6; developers and users should assess exposure and apply patches.

• Code execution on victim machine when opening or building exported Gradle project
• Potential for attacker-controlled Groovy code execution
• Requires verification of affected versions and remediation status

Technical summary

jadx inserts android:versionName from AndroidManifest into generated app/build.gradle without proper sanitization, allowing malicious APKs to execute attacker-controlled Groovy code when opening or building the exported Gradle project. This issue is fixed in version 1.5.6. Developers and users of jadx should assess exposure and apply patches to prevent code execution via malicious APKs. The vulnerability can lead to code execution on the victim machine, with potential for attacker-controlled Groovy code execution. The fix involves upgrading jadx to version 1.5.6 or later.

Defensive priority

High priority for developers and users of jadx, assess exposure and apply patches

Recommended defensive actions

• Assess exposure: Check if using jadx versions prior to 1.5.6
• Apply patches: Upgrade jadx to version 1.5.6 or later
• Verify fixes: Validate patched versions against official sources
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Official CVE and NVD records confirm jadx vulnerability; fix available in version 1.5.6. The CVE record was published on 2026-07-14T22:16:52.940Z and has not been modified since then. Evidence is based on official sources and limited to publicly available information. Further verification is recommended to ensure accuracy and completeness.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.