{"id":"CVE-2026-42049","summary":"jadx: RCE Via Groovy Code Injection in Gradle Export","details":"jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the string context so that opening or building the exported Gradle project executes attacker-controlled Groovy code on the victim machine. This issue is fixed in version 1.5.6.","aliases":["GHSA-w6f5-h4x4-rfpj"],"modified":"2026-08-12T16:25:12.801981Z","published":"2026-07-14T21:44:25.018Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42049.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-94"]},"references":[{"type":"WEB","url":"https://github.com/skylot/jadx/releases/tag/v1.5.6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42049.json"},{"type":"ADVISORY","url":"https://github.com/skylot/jadx/security/advisories/GHSA-w6f5-h4x4-rfpj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42049"},{"type":"FIX","url":"https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/skylot/jadx","events":[{"introduced":"0"},{"fixed":"5a6e660b4663d998d52c7dc4511299f3368ef611"},{"fixed":"28ff15e4ae69950aebea110a13e5ab895d234dfc"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.5.6"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.5.4","v1.5.3","v1.5.2","v1.5.1","v1.5.0","v1.4.7","v1.4.6","v1.4.5","v1.4.4","v1.4.3","v1.4.2","v1.4.1","v1.4.0","v1.3.5","v1.3.4","v1.3.3","v1.3.2","v1.3.1","v1.3.0","v1.2.0","v1.1.0","v1.0.0","v0.9.0","v0.8.0","v0.7.1","v0.6.1","v0.6.0","v0.5.4","v0.5.2","v0.5.1","v0.5.0","v0.5.0-beta1","v0.4.1","v0.4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42049.json","vanir_signatures_modified":"2026-08-12T16:25:12Z","vanir_signatures":[{"target":{"file":"jadx-core/src/main/java/jadx/core/export/gen/AndroidGradleGenerator.java","function":"saveApplicationBuildGradle"},"deprecated":false,"digest":{"function_hash":"288163336408048219475960030167136025590","length":755},"id":"CVE-2026-42049-089af8fa","signature_type":"Function","signature_version":"v1","source":"https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611","target":{"file":"jadx-core/src/main/java/jadx/core/export/gen/AndroidGradleGenerator.java"},"deprecated":false,"digest":{"line_hashes":["281016289131376062957596036495973739708","287694239607806276513057144597832066170","233938435514764624581738258658281554483","291933867134477371433966128449374353946","98393560681185202356617907373530898007","87724171842942308736145195226816610048","166690126926973030960262840278353989017","174012812577204483873752989489788294616","249918933766237245376527933398961162144","268752549117287349386557021793249107679","314499113150769886454026620131435239215","29821154308104072022671203303445422543","207420310889673444900022465625213171310","51655245204982971528952788624390190939","157427423257341549903852651902507970808","102667560049888563786885389184632431539","161256115626620984656878718305653005661","170747593651226106553479246126056954825","184680895298287143591076190824521082652","94610375993466978049029401511333716744","173320313900658598152007895082385198563","194945111895065901904787391591260581903","189805866479089629460588083976655914586","12371364356491908262257739749492166460","209289126063884432181329163558258675317","71989620995369934208630645151805251845","93471826170632140716367013997182175865","256890046075568506288909386745518773952","233742521165042388046040183459846405387","80273909530435135051866056538034139240","197554904364429822690752867364418452289","15951220397337285642245158986084395511","249093214618506486369901395665864250216","88484394802114711608982779259590003788","221212605432698122817393573929198467248","47920102818900886352522355971036063769","164474609760588849307280384880841328370","164516538205135149843425112906588057586","44988095197262845719187028919318741016","287182525616011405424469842890047276577"],"threshold":0.9},"id":"CVE-2026-42049-0aa1b1d4"},{"id":"CVE-2026-42049-14ae273f","signature_type":"Function","signature_version":"v1","source":"https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611","target":{"file":"jadx-core/src/main/java/jadx/core/export/gen/AndroidGradleGenerator.java","function":"saveSettingsGradle"},"deprecated":false,"digest":{"function_hash":"200605826723080139361908796876786168369","length":494}},{"id":"CVE-2026-42049-1d934e67","signature_type":"Function","signature_version":"v1","source":"https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611","target":{"file":"jadx-core/src/main/java/jadx/core/export/gen/AndroidGradleGenerator.java","function":"saveLibraryBuildGradle"},"deprecated":false,"digest":{"function_hash":"47039611382389837804828441449853571613","length":536}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611","target":{"file":"jadx-core/src/main/java/jadx/core/export/gen/SimpleJavaGradleGenerator.java"},"deprecated":false,"digest":{"line_hashes":["60380891849555700446422159711889148572","263339150732212631233586956745277235981","235334798944513654747949837150727194544","214251219496140412426451707931191605284","190512518228238513830995479107826950190","190167319448598154027891214348691082106","91489067966591924992255341441997051910","338868738619267839526568547670357093017","43591071417193494703448929911599895090","115746795324303682215440646615465126694","135654659210777126350395688119181788867","139151169050266672658647965235748866810","145952441580083409976308949550214174366","132231257060928830458907316253148757488","145755358786791970189377857982207178489","120546940654489559521632800452057775219"],"threshold":0.9},"id":"CVE-2026-42049-22e4f944"},{"deprecated":false,"digest":{"function_hash":"21211189021016567167417344267447544077","length":178},"id":"CVE-2026-42049-33a3be04","signature_type":"Function","signature_version":"v1","source":"https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611","target":{"file":"jadx-core/src/main/java/jadx/core/export/gen/AndroidGradleGenerator.java","function":"saveProjectBuildGradle"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611","target":{"file":"jadx-core/src/main/java/jadx/api/security/IJadxSecurity.java"},"deprecated":false,"digest":{"line_hashes":["145532636013003537296147776867167175012","165267084908489561143314214591643123624"],"threshold":0.9},"id":"CVE-2026-42049-478f44e6"},{"signature_version":"v1","source":"https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611","target":{"file":"jadx-cli/src/main/java/jadx/cli/JadxAppCommon.java","function":"applyEnvVars"},"deprecated":false,"digest":{"function_hash":"91312474043935442059337205045348384284","length":996},"id":"CVE-2026-42049-484f9ca0","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"76496752661803391767732468780527553551","length":267},"id":"CVE-2026-42049-5985d887","signature_type":"Function","signature_version":"v1","source":"https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611","target":{"file":"jadx-core/src/main/java/jadx/core/export/gen/SimpleJavaGradleGenerator.java","function":"saveSettingsGradle"}},{"signature_version":"v1","source":"https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611","target":{"file":"jadx-cli/src/main/java/jadx/cli/JadxAppCommon.java"},"deprecated":false,"digest":{"line_hashes":["318632128154434072995448374597725377677","297112074272880332320026290099701927579","296329001199180114278166907225463404751","268581358751491053802504208907172930286","283023400439043878535081843697085255401","224144849333486870308550322905739665902","25418847016925579098963859650085239472","82920869625607053259692985432021521932","89511382379665726561871313817414640369"],"threshold":0.9},"id":"CVE-2026-42049-5fc03fc5","signature_type":"Line"},{"source":"https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611","target":{"file":"jadx-core/src/main/java/jadx/api/security/JadxSecurityFlag.java"},"deprecated":false,"digest":{"line_hashes":["291842413604998829570273132394799160824","113283694975340789859137919647751519218","223005181786662103813041763890169203814","78983018009067872244011050242975969531"],"threshold":0.9},"id":"CVE-2026-42049-772d4178","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-42049-84244dec","signature_type":"Line","signature_version":"v1","source":"https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611","target":{"file":"jadx-core/src/main/java/jadx/core/export/TemplateFile.java"},"deprecated":false,"digest":{"line_hashes":["5736702217203448160911817340749320683","269077785646012521731786671408228038098","3953160868942470855393178258042074071","188551915038047674829408929840110396690","131517842696909241639389535160613361823","42245641242978504235490296543860560253","178472222843071463863548907551404072356","53739902244554524102228090014202658236","60473314653212228304019795249243042774","106139324319150188113606844472403569240","224130890452049348364582500004724822315","69885341361157049444133976295266111488","100819430640495469907189178780807760188","137761797402991123048953293328933733008","270781668128168188475370440682003486792","305051532431313851290325627427678218011","185937906041434618384040976922188598707","335195243482548404177737447753117247857","45596785230582527776253380764489428756","35608109344293713455624946810244775007","167909917521723817509373665209773787713","108317699187406803922663006781390905372","185725755161440912773454460869241499091","335669082792515419439689658568662845398","287886255874223762689833474034932762231"],"threshold":0.9}},{"id":"CVE-2026-42049-8e27ab1c","signature_type":"Function","signature_version":"v1","source":"https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611","target":{"file":"jadx-core/src/main/java/jadx/core/export/TemplateFile.java","function":"processVar"},"deprecated":false,"digest":{"function_hash":"195026456373462412173730696681505867856","length":202}},{"signature_version":"v1","source":"https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611","target":{"file":"jadx-core/src/main/java/jadx/api/security/impl/JadxSecurity.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["35296383378740507806186629837837755854","20728610398563277131024538025233690889","228395876099640181687101785253008253681","296775288296390487654547713451006010434","263578867129224240214967830231569765032","167030040373834431943690308768171913182","330403257613805298443926165337355773598","253292691156016515512251825854210042510","166132038710371337070642381827730998860","891996571536406465834636895654529905","108659887538657162577655635730828953433","185756869575263370306924456355459569235"]},"id":"CVE-2026-42049-d1f642c5","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611","target":{"file":"jadx-core/src/main/java/jadx/core/export/TemplateFile.java","function":"process"},"deprecated":false,"digest":{"length":922,"function_hash":"119991754765892574135646701889859547022"},"id":"CVE-2026-42049-db47ea80"},{"id":"CVE-2026-42049-e6286c59","signature_type":"Function","signature_version":"v1","source":"https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611","target":{"file":"jadx-core/src/main/java/jadx/core/export/gen/SimpleJavaGradleGenerator.java","function":"saveBuildGradle"},"deprecated":false,"digest":{"function_hash":"39401966052726628213303447894009379497","length":179}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}