CVE-2026-42447

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42447", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-27T13:55:58.693Z", "datePublished": "2026-07-14T21:45:33.878Z", "dateUpdated": "2026-07-15T17:39:26.549Z"}, "containers": {"cna": {"title": "jadx: HTML Injection in Summary panel", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.6, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/skylot/jadx/security/advisories/GHSA-jwv3-q635-w9m4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/skylot/jadx/security/advisories/GHSA-jwv3-q635-w9m4"}, {"name": "https://github.com/skylot/jadx/commit/7713655feeb8e1c4b80797e8fc0e8eb1550b65ef", "tags": ["x_refsource_MISC"], "url": "https://github.com/skylot/jadx/commit/7713655feeb8e1c4b80797e8fc0e8eb1550b65ef"}, {"name": "https://github.com/skylot/jadx/releases/tag/v1.5.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/skylot/jadx/releases/tag/v1.5.6"}], "affected": [{"vendor": "skylot", "product": "jadx", "versions": [{"version": "< 1.5.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-14T21:45:33.878Z"}, "descriptions": [{"lang": "en", "value": "jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx-gui is affected by an HTML injection vulnerability in the Summary tab because SummaryNode.java appends arches and perArchCount values derived from .so file path components inside an APK into an HTML panel without escaping. A malicious APK with an HTML URL-encoded ZIP entry name can force rendering of arbitrary HTML, perform out-of-band requests, disclose the victim IP address, or interact with locally exposed applications. This issue is fixed in version 1.5.6."}], "source": {"advisory": "GHSA-jwv3-q635-w9m4", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/skylot/jadx/security/advisories/GHSA-jwv3-q635-w9m4", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-15T17:39:21.622156Z", "id": "CVE-2026-42447", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T17:39:26.549Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "jadx: HTML Injection in Summary panel", "source": {"advisory": "GHSA-jwv3-q635-w9m4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.6, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "skylot", "product": "jadx", "versions": [{"status": "affected", "version": "< 1.5.6"}]}], "references": [{"url": "https://github.com/skylot/jadx/security/advisories/GHSA-jwv3-q635-w9m4", "name": "https://github.com/skylot/jadx/security/advisories/GHSA-jwv3-q635-w9m4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/skylot/jadx/commit/7713655feeb8e1c4b80797e8fc0e8eb1550b65ef", "name": "https://github.com/skylot/jadx/commit/7713655feeb8e1c4b80797e8fc0e8eb1550b65ef", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/skylot/jadx/releases/tag/v1.5.6", "name": "https://github.com/skylot/jadx/releases/tag/v1.5.6", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx-gui is affected by an HTML injection vulnerability in the Summary tab because SummaryNode.java appends arches and perArchCount values derived from .so file path components inside an APK into an HTML panel without escaping. A malicious APK with an HTML URL-encoded ZIP entry name can force rendering of arbitrary HTML, perform out-of-band requests, disclose the victim IP address, or interact with locally exposed applications. This issue is fixed in version 1.5.6."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-14T21:45:33.878Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42447", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-15T17:39:21.622156Z"}}}], "references": [{"url": "https://github.com/skylot/jadx/security/advisories/GHSA-jwv3-q635-w9m4", "tags": ["exploit"]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-07-15T17:39:13.534Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-42447", "state": "PUBLISHED", "dateUpdated": "2026-07-14T21:45:33.878Z", "dateReserved": "2026-04-27T13:55:58.693Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-14T21:45:33.878Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "jadx", "vendor": "skylot", "versions": [{"status": "affected", "version": "< 1.5.6"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jadx_project:jadx:*:*:*:*:*:*:*:*", "matchCriteriaId": "9BDF2AA2-3495-47C9-90D8-E4C039171448", "versionEndExcluding": "1.5.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx-gui is affected by an HTML injection vulnerability in the Summary tab because SummaryNode.java appends arches and perArchCount values derived from .so file path components inside an APK into an HTML panel without escaping. A malicious APK with an HTML URL-encoded ZIP entry name can force rendering of arbitrary HTML, perform out-of-band requests, disclose the victim IP address, or interact with locally exposed applications. This issue is fixed in version 1.5.6."}, {"lang": "es", "value": "jadx es un descompilador de Dex a Java. Antes de la versi\u00f3n 1.5.6, jadx-gui se ve afectado por una vulnerabilidad de inyecci\u00f3n HTML en la pesta\u00f1a Summary porque SummaryNode.java a\u00f1ade los valores arches y perArchCount derivados de los componentes de la ruta de archivos .so dentro de un APK en un panel HTML sin escapar. Un APK malicioso con un nombre de entrada ZIP codificado en URL HTML puede forzar la renderizaci\u00f3n de HTML arbitrario, realizar solicitudes fuera de banda, divulgar la direcci\u00f3n IP de la v\u00edctima o interactuar con aplicaciones expuestas localmente. Este problema se ha solucionado en la versi\u00f3n 1.5.6."}], "id": "CVE-2026-42447", "lastModified": "2026-10-24T22:10:00.210", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.6, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42447", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-15T17:39:21.622156Z", "version": "2.0.3"}}]}, "published": "2026-07-14T22:16:53.087", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/skylot/jadx/commit/7713655feeb8e1c4b80797e8fc0e8eb1550b65ef"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/skylot/jadx/releases/tag/v1.5.6"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/skylot/jadx/security/advisories/GHSA-jwv3-q635-w9m4"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/skylot/jadx/security/advisories/GHSA-jwv3-q635-w9m4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.5.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "jadx", "source": "cna", "vendor": "skylot"}, "product": "jadx", "vendor": "skylot"}], "created": "2026-07-15T14:45:03.223313+00:00", "updated": "2026-07-31T04:30:03.678779+00:00", "vendors": ["skylot", "skylot$PRODUCT$jadx"]}