# CVE-2026-42049: skylot jadx Groovy code injection in Gradle export

Source: https://junglewise.ai/threats/cve-2026-42049-skylot-jadx-groovy-code-injection-in-gradle-export  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-42049 · Severity: info · CVSS 8.4 · Published 2026-07-14

Jadx is a tool used by developers and security researchers to decompile Android applications (APKs) into readable Java code. A vulnerability exists where a specially crafted malicious APK can trick the tool into generating a compromised project file. If a user exports this project and then opens or builds it in a development environment like Android Studio, the attacker's hidden code will run on the user's computer, potentially leading to a full system takeover or data theft.

Technologies: [Skylot Jadx](https://junglewise.ai/threats/technologies/jadx). Vendors: [Skylot](https://junglewise.ai/threats/vendors/skylot).

## Quick answers

**Is CVE-2026-42049 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42049 being exploited in the wild.

**How severe is CVE-2026-42049?** Informational severity, with a CVSS score of 8.4, published 14 July 2026.

**Which products and versions are affected?** Skylot Jadx <= 1.5.5; Skylot Jadx-Gui <= 1.5.5.

**Is there a fix for CVE-2026-42049?** A patch was published on 2026-07-09: Fix commit 5a6e660b4663d998d52c7dc4511299f3368ef611 pushed to GitHub. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42049 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-42049?** Check whether you run Skylot Jadx or Skylot Jadx-Gui at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A code injection vulnerability (CWE-94) exists in jadx prior to version 1.5.6. The issue resides in the Gradle export functionality, where the 'android:versionName' attribute from an APK's AndroidManifest.xml is inserted into the generated 'app/build.gradle' Groovy template without sanitization. An attacker can craft a malicious APK with a version name that breaks out of the Groovy string context (e.g., using quotes and semicolons). When a victim exports the project and subsequently opens it in an IDE or runs a Gradle build, the injected Groovy code executes with the privileges of the user. This has been fixed in version 1.5.6 by implementing proper string sanitization for Gradle script exports.

## Affected products

- skylot jadx-gui <= 1.5.5
- skylot jadx < 1.5.6

## Timeline

- 2026-07-09: patched: Fix commit 5a6e660b4663d998d52c7dc4511299f3368ef611 pushed to GitHub.
- 2026-07-10: advisory: GitHub Security Advisory GHSA-w6f5-h4x4-rfpj published.
- 2026-07-14: disclosed: CVE-2026-42049 published to NVD.

## References

- [https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611](https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611)
- [https://github.com/skylot/jadx/releases/tag/v1.5.6](https://github.com/skylot/jadx/releases/tag/v1.5.6)
- [https://github.com/skylot/jadx/security/advisories/GHSA-w6f5-h4x4-rfpj](https://github.com/skylot/jadx/security/advisories/GHSA-w6f5-h4x4-rfpj)

## Related threats

- [skylot jadx path traversal and RCE via malicious XAPK plugin planting](https://junglewise.ai/threats/cve-2026-54684-skylot-jadx-path-traversal-and-rce-via-malicious-xapk-plugin)
- [skylot jadx-gui HTML injection in Summary tab](https://junglewise.ai/threats/cve-2026-42447-skylot-jadx-gui-html-injection-in-summary-tab)