CVE-2026-42049: jadx Decompiler RCE Vulnerability

CVE-2026-42049 Overview

CVE-2026-42049 is a code injection vulnerability [CWE-94] in jadx, a widely used Dex to Java decompiler. Versions prior to 1.5.6 fail to sanitize the android:versionName value from an AndroidManifest.xml when generating an app/build.gradle Groovy template during Android Gradle project export. A crafted APK can break out of the Groovy string context and inject attacker-controlled code. Opening or building the exported Gradle project then executes that code on the analyst's machine. The maintainers fixed the issue in jadx version 1.5.6.

Critical Impact
A malicious APK analyzed with jadx can achieve arbitrary code execution on the reverse engineer's workstation when the exported Gradle project is opened or built.

Affected Products

jadx versions prior to 1.5.6
jadx-cli and jadx-gui Android Gradle project export functionality
Downstream tools bundling vulnerable jadx releases

Discovery Timeline

2026-07-14 - CVE-2026-42049 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-42049

Vulnerability Analysis

The flaw resides in the Export as Gradle project workflow of jadx. When the tool converts a decompiled APK into an Android Gradle project, it reads metadata from the APK's AndroidManifest.xml and inlines several string values into a Groovy build.gradle template. The android:versionName attribute is copied verbatim into a Groovy string literal without escaping quotes, backslashes, or Groovy interpolation syntax.

Because Groovy allows expression evaluation inside double-quoted strings and permits closing a literal to execute arbitrary statements, a manifest value crafted with a closing quote followed by Groovy code alters the structure of the generated script. The malicious statements become part of the build.gradle body and run inside the Gradle daemon whenever the project is imported into Android Studio, opened in IntelliJ IDEA, or built with gradle/gradlew.

Root Cause

The underlying issue is missing output-context sanitization when embedding untrusted APK metadata into a Groovy build script. jadx treated versionName as a benign display string rather than an attacker-controlled value requiring Groovy string escaping.

Attack Vector

Exploitation requires an analyst to decompile a hostile APK with jadx and export it as a Gradle project, then open or build that project. This maps to a local attack vector with user interaction, but the payload is fully controlled by the APK author and delivered through normal reverse-engineering workflows.

java

// Patch: jadx-core/src/main/java/jadx/api/security/IJadxSecurity.java
// Source: https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611

	 * XML document parser
	 */
	Document parseXml(InputStream in);
+
+	/**
+	 * Sanitize/escape string to make it safe for use in place described by SanitizeType
+	 */
+	String sanitizeString(String str, SanitizeType type);
}

The fix introduces a sanitizeString(String, SanitizeType) API on IJadxSecurity so that every value inlined into a generated Gradle script is escaped according to its output context. A companion change in jadx-cli/src/main/java/jadx/cli/JadxAppCommon.java also adds a JADX_DISABLE_ALL_SECURITY_FLAGS environment toggle, keeping security flags on by default.

Detection Methods for CVE-2026-42049

Indicators of Compromise

APK files containing an android:versionName value with quote characters, backslashes, or Groovy interpolation markers such as ${.
Generated app/build.gradle files where the versionName assignment spans multiple lines or contains executable Groovy statements outside the intended string literal.
Unexpected child processes of java, gradle, gradlew, or Android Studio launched shortly after opening a jadx-exported project.

Detection Strategies

Statically scan AndroidManifest.xml in samples for non-printable or syntactically dangerous characters in versionName and versionCode before running jadx export.
Diff exported build.gradle files against a known-good template and alert on any tokens outside the expected key-value structure.
Hunt for process-lineage anomalies where a build tool spawns shells, curl, wget, powershell, or python interpreters on analyst workstations.

Monitoring Recommendations

Log invocations of jadx, jadx-gui, and Gradle commands on reverse-engineering hosts and forward them to a central data store for correlation.
Monitor outbound network connections from build tooling, which should rarely contact arbitrary internet hosts during project import.
Track file writes to sensitive locations such as ~/.ssh, ~/.aws, and startup directories from java-family processes.

How to Mitigate CVE-2026-42049

Immediate Actions Required

Upgrade all instances of jadx, jadx-cli, and jadx-gui to version 1.5.6 or later.
Audit malware analysis and reverse engineering workstations for older jadx installations bundled with IDE plugins or forensic distributions.
Do not open or build Gradle projects previously exported from untrusted APKs with vulnerable jadx versions until they are regenerated or reviewed.

Patch Information

The fix is delivered in jadx release v1.5.6 via commit 5a6e660. Additional context is available in GitHub Security Advisory GHSA-w6f5-h4x4-rfpj.

Workarounds

Analyze untrusted APKs inside disposable virtual machines or containers isolated from production credentials and networks.
Avoid the Export as Gradle project feature on untrusted samples until upgrading to 1.5.6.
Manually inspect generated build.gradle files for injected Groovy before opening the project in an IDE or invoking Gradle.

bash

# Verify installed jadx version and upgrade if below 1.5.6
jadx --version

# Example upgrade via GitHub release
curl -LO https://github.com/skylot/jadx/releases/download/v1.5.6/jadx-1.5.6.zip
unzip -o jadx-1.5.6.zip -d /opt/jadx-1.5.6
export PATH=/opt/jadx-1.5.6/bin:$PATH
jadx --version