CVE-2026-42447 Overview
CVE-2026-42447 is an HTML injection vulnerability in jadx-gui, the graphical interface for the popular Dex to Java decompiler. Versions prior to 1.5.6 fail to escape values derived from .so file path components inside Android Package (APK) files. The SummaryNode.java component appends arches and perArchCount values into an HTML panel without sanitization. A crafted APK containing an HTML URL-encoded ZIP entry name can force jadx-gui to render arbitrary HTML content. The flaw is classified as Cross-Site Scripting [CWE-79] and was fixed in jadx version 1.5.6.
Critical Impact
A malicious APK can trigger arbitrary HTML rendering in the Summary tab, enabling out-of-band requests, victim IP address disclosure, and interaction with locally exposed applications.
Affected Products
- jadx-gui versions prior to 1.5.6
- jadx Dex to Java decompiler graphical interface
- Systems using jadx to analyze untrusted APK files
Discovery Timeline
- 2026-07-14 - CVE-2026-42447 published to NVD
- 2026-07-15 - Last updated in NVD database
- Fixed in version 1.5.6 - Patch released via GitHub Release v1.5.6
Technical Details for CVE-2026-42447
Vulnerability Analysis
The vulnerability resides in jadx-gui/src/main/java/jadx/gui/ui/treenodes/SummaryNode.java. When jadx-gui builds the Summary tab for an opened APK, it enumerates native library architectures by parsing paths of embedded .so files. The extracted arches and perArchCount values are concatenated into an HTML output buffer using builder.append() without escaping.
An attacker who controls the ZIP entry names inside an APK can inject URL-encoded HTML markup that decodes and renders inside the Summary panel. Because the panel supports HTML rendering, injected <img>, <iframe>, or similar tags can trigger network callbacks. This allows attackers to fingerprint the analyst workstation, disclose its public IP address via out-of-band DNS or HTTP requests, and probe services listening on localhost.
Root Cause
The root cause is missing output encoding on attacker-controlled data flowing from APK contents into an HTML sink. The Summary builder used append() for stack traces and metadata rather than the escape() helper. Any values sourced from ZIP entry names inherit the trust of the local decompilation session.
Attack Vector
Exploitation requires an analyst to open a malicious APK in jadx-gui. The attack vector is local and requires user interaction, but the impact crosses trust boundaries because rendered HTML can reach network resources outside the workstation.
} catch (Exception e) {
builder.append("Error build summary: ");
builder.append("<pre>");
- builder.append(Utils.getStackTrace(e));
+ builder.escape(Utils.getStackTrace(e));
builder.append("</pre>");
}
return new SimpleCodeInfo(builder.toString());
Source: GitHub Commit 7713655 — the patch replaces unsafe append() calls with escape() to neutralize HTML metacharacters before rendering.
Detection Methods for CVE-2026-42447
Indicators of Compromise
- APK samples containing ZIP entries under lib/ with URL-encoded HTML characters such as %3C, %3E, or %22 in directory names.
- Outbound HTTP or DNS requests originating from jadx-gui processes to unfamiliar external hosts during APK analysis.
- Connections from the jadx-gui process to 127.0.0.1 or other loopback services following the opening of an untrusted APK.
Detection Strategies
- Inspect APK samples with static ZIP tooling before opening in jadx-gui, flagging any entry names containing angle brackets, quotes, or URL-encoded equivalents.
- Monitor endpoint telemetry for network egress initiated by the Java process running jadx-gui, which normally operates offline during decompilation.
- Deploy application allowlisting to identify jadx-gui versions below 1.5.6 across analyst workstations.
Monitoring Recommendations
- Alert on jadx-gui processes making outbound connections to non-corporate domains or opening sockets to localhost services.
- Log APK file opens in reverse-engineering environments and correlate with subsequent DNS lookups from the same host.
- Track jadx binary versions in software inventory to confirm remediation across all analyst systems.
How to Mitigate CVE-2026-42447
Immediate Actions Required
- Upgrade jadx-gui to version 1.5.6 or later on all analyst workstations, available from GitHub Release v1.5.6.
- Analyze untrusted APKs only inside isolated virtual machines or sandboxes with no network egress until patching completes.
- Review the GitHub Security Advisory GHSA-jwv3-q635-w9m4 for full remediation guidance.
Patch Information
The fix is included in jadx 1.5.6. Commit 7713655feeb8e1c4b80797e8fc0e8eb1550b65ef introduces proper HTML escaping in SummaryNode.java by replacing builder.append() with builder.escape() on attacker-influenced values.
Workarounds
- Avoid opening the Summary tab for APKs from untrusted sources when running versions prior to 1.5.6.
- Run jadx-gui inside a network-isolated container or firewall the process to block outbound connections during triage.
- Pre-screen APK contents with unzip -l and reject archives containing suspicious characters in lib/ entry names.
# Verify installed jadx version and upgrade
jadx-gui --version
# Download and install jadx 1.5.6
wget https://github.com/skylot/jadx/releases/download/v1.5.6/jadx-1.5.6.zip
unzip jadx-1.5.6.zip -d /opt/jadx-1.5.6
# Optional: block outbound traffic from jadx during analysis (Linux example)
sudo iptables -A OUTPUT -m owner --uid-owner analyst -p tcp -m string \
--string "jadx" --algo bm -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
