These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
This CVE debrief provides an executive overview of CVE-2026-54684, a vulnerability in jadx, a Dex to Java decompiler. The vulnerability allows a malicious .xapk file to write attacker-controlled archive entry contents outside the intended XAPK plugin temporary unpack directory. This issue is fixed in version 1.5.6. Defenders should assess exposure and prioritize verification and remediation. The CVE recor [truncated]
jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx-gui is affected by an HTML injection vulnerability in the Summary tab because SummaryNode.java appends arches and perArchCount values derived from .so file path components inside an APK into an HTML panel without escaping. A malicious APK with an HTML URL-encoded ZIP entry name can force rendering of arbitrary HTML, perform out-of-band requests, discl [truncated]
CVE-2026-42049 debrief: jadx vulnerability allows code execution via malicious APK, enabling attackers to execute Groovy code when opening or building exported Gradle projects. This issue is fixed in version 1.5.6. Developers and users should assess exposure and apply patches to prevent code execution via malicious APKs. The vulnerability stems from improper sanitization of the android:versionName value f [truncated]