Executive brief
jadx, a tool used by developers and security researchers to decompile Android applications, is vulnerable to a security flaw when processing malicious .xapk files. An attacker can craft a specially designed file that, when opened, secretly installs a malicious plugin into the tool's configuration folder. The next time the user runs the application, this malicious code will automatically execute, potentially allowing the attacker to take control of the user's system or access sensitive data.
Technical details
A path traversal vulnerability exists in the XApkLoader component of jadx due to improper handling of ZIP entry names. While the tool performs a security check against the current working directory (CWD), it uses Path.resolve() on absolute paths provided within the archive, which causes the base temporary directory to be ignored. If a user opens a malicious .xapk file while jadx is running from a directory that is an ancestor of its configuration directory, an attacker can write a JAR file into the 'plugins/dropins' folder. This JAR is then automatically loaded and executed via URLClassLoader and ServiceLoader during the subsequent launch of jadx. The issue is fixed in version 1.5.6 by rejecting absolute paths and paths pointing to the CWD in ZIP entries.
Affected products
- skylot jadx 1.5.2 - 1.5.5
Timeline
- 2026-07-10: patched: Version 1.5.6 released
- 2026-07-14: disclosed: CVE-2026-54684 published