Vulnerability	Vulnerable Version
H Arbitrary Code Injection Affected versions of this package are vulnerable to Arbitrary Code Injection via the process that inserts the `android:versionName` value from an AndroidManifest into the generated `app/build.gradle` Groovy template without proper sanitization. An attacker can execute arbitrary code by crafting a malicious APK that injects Groovy code, which is then run when the exported Gradle project is opened or built. How to fix Arbitrary Code Injection? Upgrade `io.github.skylot:jadx-core` to version 1.5.6 or higher.	[,1.5.6)
L Directory Traversal Affected versions of this package are vulnerable to Directory Traversal due to an escape problem with the `style` file during the parsing of a resource file. An attacker can overwrite other files in the directory where the decompile result is saved by modifying the type of a malicious file to `style` and tricking the software into processing it as such. This manipulation involves changing the original filename in a way that causes the software to save the decompiled result in an unintended location. How to fix Directory Traversal? Upgrade `io.github.skylot:jadx-core` to version 1.5.0 or higher.	[,1.5.0)

Arbitrary Code Injection

Affected versions of this package are vulnerable to Arbitrary Code Injection via the process that inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization. An attacker can execute arbitrary code by crafting a malicious APK that injects Groovy code, which is then run when the exported Gradle project is opened or built.

How to fix Arbitrary Code Injection?

Upgrade io.github.skylot:jadx-core to version 1.5.6 or higher.

[,1.5.6)

Directory Traversal

Affected versions of this package are vulnerable to Directory Traversal due to an escape problem with the style file during the parsing of a resource file. An attacker can overwrite other files in the directory where the decompile result is saved by modifying the type of a malicious file to style and tricking the software into processing it as such. This manipulation involves changing the original filename in a way that causes the software to save the decompiled result in an unintended location.

How to fix Directory Traversal?

Upgrade io.github.skylot:jadx-core to version 1.5.0 or higher.

[,1.5.0)

Go back to all versions of this package