Is CVE-2026-54684 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54684 being exploited in the wild.

How severe is CVE-2026-54684?

High severity, with a CVSS score of 7, published 14 July 2026.

Is there a fix for CVE-2026-54684?

A patch was published on 2026-07-10: Version 1.5.6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54684 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-54684?

Check whether you run Skylot Jadx at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54684: skylot jadx path traversal and RCE via malicious XAPK plugin planting

CVE-2026-54684 · Severity: high · CVSS 7 · Published 2026-07-14

jadx, a tool used by developers and security researchers to decompile Android applications, is vulnerable to a security flaw when processing malicious .xapk files. An attacker can craft a specially designed file that, when opened, secretly installs a malicious plugin into the tool's configuration folder. The next time the user runs the application, this malicious code will automatically execute, potentially allowing the attacker to take control of the user's system or access sensitive data.

Technologies: Skylot Jadx. Vendors: Skylot.

Quick answers

Is CVE-2026-54684 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54684 being exploited in the wild.
How severe is CVE-2026-54684?: High severity, with a CVSS score of 7, published 14 July 2026.
Which products and versions are affected?: Skylot Jadx 1.5.2 - 1.5.5.
Is there a fix for CVE-2026-54684?: A patch was published on 2026-07-10: Version 1.5.6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54684 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-54684?: Check whether you run Skylot Jadx at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability exists in the XApkLoader component of jadx due to improper handling of ZIP entry names. While the tool performs a security check against the current working directory (CWD), it uses Path.resolve() on absolute paths provided within the archive, which causes the base temporary directory to be ignored. If a user opens a malicious .xapk file while jadx is running from a directory that is an ancestor of its configuration directory, an attacker can write a JAR file into the 'plugins/dropins' folder. This JAR is then automatically loaded and executed via URLClassLoader and ServiceLoader during the subsequent launch of jadx. The issue is fixed in version 1.5.6 by rejecting absolute paths and paths pointing to the CWD in ZIP entries.

Affected products

skylot jadx 1.5.2 - 1.5.5

Timeline

2026-07-10: patched: Version 1.5.6 released
2026-07-14: disclosed: CVE-2026-54684 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.