CVE-2026-42447

Name of the Vulnerable Software and Affected Versions jadx versions prior to 1.5.6

Description The Summary tab in jadx-gui allows HTML injection because the SummaryNode.java file appends arches and perArchCount values, derived from .so file path components within an APK, into an HTML panel without proper escaping. An attacker can use a malicious APK containing an HTML URL-encoded ZIP entry name to force the rendering of arbitrary HTML. This can lead to out-of-band requests, disclosure of the victim's IP address, or interaction with locally exposed applications.

Recommendations Update to version 1.5.6.