CyberRota Analysis
AI-GeneratedThe jadx decompiler for Android and Java is vulnerable due to improper sanitization of the android:versionName value when exporting decompiled APKs, potentially allowing a malicious APK to execute attacker-controlled Groovy code on the victim's machine. This poses a significant risk for developers and organizations using jadx prior to version 1.5.6, as it could lead to code execution vulnerabilities. Users of affected versions should prioritize upgrading to version 1.5.6 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the string context so that opening or building the exported Gradle project executes attacker-controlled Groovy code on the victim machine. This issue is fixed in version 1.5.6.