CVE-2026-42447 jadx: HTML Injection in Summary panel

Low 3.6 Published 14 Jul 2026 Updated 15 Jul 2026

Attackers can inject HTML into jadx-gui via malicious APKs, enabling IP disclosure or local application interaction.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-42447?

CVE-2026-42447 is a low-severity cross-site scripting vulnerability in skylot jadx, published on 14 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx-gui is affected by an HTML injection vulnerability in the Summary tab because SummaryNode.java appends arches and perArchCount values derived from .so file path components inside an APK into an HTML panel without escaping. A malicious APK with an HTML URL-encoded ZIP entry name can force rendering of arbitrary HTML, perform out-of-band requests, disclose the victim IP address, or interact with locally exposed applications. This issue is fixed in version 1.5.6.

Weakness: CWE-79

Which versions are affected by CVE-2026-42447?

It affects 1 product.

Products include Jadx Project Jadx.

How do I fix CVE-2026-42447?

No fix has been published for CVE-2026-42447 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2026-42447 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42447 exists.

Sources

Also known as GHSA-jwv3-q635-w9m4.