CVE-2026-42447 skylot CVE debrief

Who should care

Users of jadx versions prior to 1.5.6, developers and maintainers of jadx, and security teams monitoring for vulnerabilities in software development tools should be aware of this issue. They should assess their exposure, apply the patch, and monitor for suspicious activity. Additionally, security teams should review their current vulnerability management processes to ensure they can detect and respond to similar issues in the future.

Technical summary

The jadx-gui is affected by an HTML injection vulnerability in the Summary tab. A malicious APK with an HTML URL-encoded ZIP entry name can force rendering of arbitrary HTML, perform out-of-band requests, disclose the victim IP address, or interact with locally exposed applications. This issue arises because SummaryNode.java appends arches and perArchCount values derived from .so file path components inside an APK into an HTML panel without escaping.

Defensive priority

Low priority, as CVSS score is 3.6 and severity is LOW.

Recommended defensive actions

• Inventory and check for jadx versions prior to 1.5.6
• Apply patch (version 1.5.6) to fix the issue
• Monitor for suspicious APK files and URL-encoded ZIP entry names
• Review system logs for potential exploitation attempts
• Verify the patch has been applied
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD detail provide information about the vulnerability. The jadx project has released a patch (version 1.5.6) to fix the issue. Limited evidence is available about the vulnerability's impact and affected scope. Defenders should verify the patch has been applied, monitor for suspicious APK files and URL-encoded ZIP entry names, and review system logs for potential exploitation attempts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.