CVE-2026-42049: skylot jadx Groovy code injection in Gradle export

CVE-2026-42049 · Severity: info · CVSS 8.4 · Published 2026-07-14

Jadx is a tool used by developers and security researchers to decompile Android applications (APKs) into readable Java code. A vulnerability exists where a specially crafted malicious APK can trick the tool into generating a compromised project file. If a user exports this project and then opens or builds it in a development environment like Android Studio, the attacker's hidden code will run on the user's computer, potentially leading to a full system takeover or data theft.

Technologies: Skylot Jadx. Vendors: Skylot.

Quick answers

Is CVE-2026-42049 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42049 being exploited in the wild.
How severe is CVE-2026-42049?
Informational severity, with a CVSS score of 8.4, published 14 July 2026.
Which products and versions are affected?
Skylot Jadx <= 1.5.5; Skylot Jadx-Gui <= 1.5.5.
Is there a fix for CVE-2026-42049?
A patch was published on 2026-07-09: Fix commit 5a6e660b4663d998d52c7dc4511299f3368ef611 pushed to GitHub. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42049 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-42049?
Check whether you run Skylot Jadx or Skylot Jadx-Gui at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A code injection vulnerability (CWE-94) exists in jadx prior to version 1.5.6. The issue resides in the Gradle export functionality, where the 'android:versionName' attribute from an APK's AndroidManifest.xml is inserted into the generated 'app/build.gradle' Groovy template without sanitization. An attacker can craft a malicious APK with a version name that breaks out of the Groovy string context (e.g., using quotes and semicolons). When a victim exports the project and subsequently opens it in an IDE or runs a Gradle build, the injected Groovy code executes with the privileges of the user. This has been fixed in version 1.5.6 by implementing proper string sanitization for Gradle script exports.

Affected products

  • skylot jadx-gui <= 1.5.5
  • skylot jadx < 1.5.6

Timeline

  • 2026-07-09: patched: Fix commit 5a6e660b4663d998d52c7dc4511299f3368ef611 pushed to GitHub.
  • 2026-07-10: advisory: GitHub Security Advisory GHSA-w6f5-h4x4-rfpj published.
  • 2026-07-14: disclosed: CVE-2026-42049 published to NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.