CVE-2026-42049
- Source
- https://cve.org/CVERecord?id=CVE-2026-42049
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42049.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-42049
- Aliases
-
- GHSA-w6f5-h4x4-rfpj
- Published
- 2026-07-14T21:44:25Z
- Modified
- 2026-08-12T16:25:12Z
- Severity
-
- 8.4 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- jadx: RCE Via Groovy Code Injection in Gradle Export
- Details
-
jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the string context so that opening or building the exported Gradle project executes attacker-controlled Groovy code on the victim machine. This issue is fixed in version 1.5.6.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-94" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42049.json" }- References
-
- https://github.com/skylot/jadx/releases/tag/v1.5.6
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42049.json
- https://github.com/skylot/jadx/security/advisories/GHSA-w6f5-h4x4-rfpj
- https://nvd.nist.gov/vuln/detail/CVE-2026-42049
- https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611
Affected packages
Git / github.com/skylot/jadx
Affected versions
v0.*
v0.4
v0.4.1
v0.5.0
v0.5.0-beta1
v0.5.1
v0.5.2
v0.5.4
v0.6.0
v0.6.1
v0.7.1
v0.8.0
v0.9.0
v1.*
v1.0.0
v1.1.0
v1.2.0
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.4.6
v1.4.7
v1.5.0
v1.5.1
v1.5.2
v1.5.3
v1.5.4
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42049.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "288163336408048219475960030167136025590",
"length": 755
},
"id": "CVE-2026-42049-089af8fa",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611",
"target": {
"file": "jadx-core/src/main/java/jadx/core/export/gen/AndroidGradleGenerator.java",
"function": "saveApplicationBuildGradle"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"281016289131376062957596036495973739708",
"287694239607806276513057144597832066170",
"233938435514764624581738258658281554483",
"291933867134477371433966128449374353946",
"98393560681185202356617907373530898007",
"87724171842942308736145195226816610048",
"166690126926973030960262840278353989017",
"174012812577204483873752989489788294616",
"249918933766237245376527933398961162144",
"268752549117287349386557021793249107679",
"314499113150769886454026620131435239215",
"29821154308104072022671203303445422543",
"207420310889673444900022465625213171310",
"51655245204982971528952788624390190939",
"157427423257341549903852651902507970808",
"102667560049888563786885389184632431539",
"161256115626620984656878718305653005661",
"170747593651226106553479246126056954825",
"184680895298287143591076190824521082652",
"94610375993466978049029401511333716744",
"173320313900658598152007895082385198563",
"194945111895065901904787391591260581903",
"189805866479089629460588083976655914586",
"12371364356491908262257739749492166460",
"209289126063884432181329163558258675317",
"71989620995369934208630645151805251845",
"93471826170632140716367013997182175865",
"256890046075568506288909386745518773952",
"233742521165042388046040183459846405387",
"80273909530435135051866056538034139240",
"197554904364429822690752867364418452289",
"15951220397337285642245158986084395511",
"249093214618506486369901395665864250216",
"88484394802114711608982779259590003788",
"221212605432698122817393573929198467248",
"47920102818900886352522355971036063769",
"164474609760588849307280384880841328370",
"164516538205135149843425112906588057586",
"44988095197262845719187028919318741016",
"287182525616011405424469842890047276577"
],
"threshold": 0.9
},
"id": "CVE-2026-42049-0aa1b1d4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611",
"target": {
"file": "jadx-core/src/main/java/jadx/core/export/gen/AndroidGradleGenerator.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "200605826723080139361908796876786168369",
"length": 494
},
"id": "CVE-2026-42049-14ae273f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611",
"target": {
"file": "jadx-core/src/main/java/jadx/core/export/gen/AndroidGradleGenerator.java",
"function": "saveSettingsGradle"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "47039611382389837804828441449853571613",
"length": 536
},
"id": "CVE-2026-42049-1d934e67",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611",
"target": {
"file": "jadx-core/src/main/java/jadx/core/export/gen/AndroidGradleGenerator.java",
"function": "saveLibraryBuildGradle"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"60380891849555700446422159711889148572",
"263339150732212631233586956745277235981",
"235334798944513654747949837150727194544",
"214251219496140412426451707931191605284",
"190512518228238513830995479107826950190",
"190167319448598154027891214348691082106",
"91489067966591924992255341441997051910",
"338868738619267839526568547670357093017",
"43591071417193494703448929911599895090",
"115746795324303682215440646615465126694",
"135654659210777126350395688119181788867",
"139151169050266672658647965235748866810",
"145952441580083409976308949550214174366",
"132231257060928830458907316253148757488",
"145755358786791970189377857982207178489",
"120546940654489559521632800452057775219"
],
"threshold": 0.9
},
"id": "CVE-2026-42049-22e4f944",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611",
"target": {
"file": "jadx-core/src/main/java/jadx/core/export/gen/SimpleJavaGradleGenerator.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "21211189021016567167417344267447544077",
"length": 178
},
"id": "CVE-2026-42049-33a3be04",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611",
"target": {
"file": "jadx-core/src/main/java/jadx/core/export/gen/AndroidGradleGenerator.java",
"function": "saveProjectBuildGradle"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"145532636013003537296147776867167175012",
"165267084908489561143314214591643123624"
],
"threshold": 0.9
},
"id": "CVE-2026-42049-478f44e6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611",
"target": {
"file": "jadx-core/src/main/java/jadx/api/security/IJadxSecurity.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "91312474043935442059337205045348384284",
"length": 996
},
"id": "CVE-2026-42049-484f9ca0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611",
"target": {
"file": "jadx-cli/src/main/java/jadx/cli/JadxAppCommon.java",
"function": "applyEnvVars"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "76496752661803391767732468780527553551",
"length": 267
},
"id": "CVE-2026-42049-5985d887",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611",
"target": {
"file": "jadx-core/src/main/java/jadx/core/export/gen/SimpleJavaGradleGenerator.java",
"function": "saveSettingsGradle"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"318632128154434072995448374597725377677",
"297112074272880332320026290099701927579",
"296329001199180114278166907225463404751",
"268581358751491053802504208907172930286",
"283023400439043878535081843697085255401",
"224144849333486870308550322905739665902",
"25418847016925579098963859650085239472",
"82920869625607053259692985432021521932",
"89511382379665726561871313817414640369"
],
"threshold": 0.9
},
"id": "CVE-2026-42049-5fc03fc5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611",
"target": {
"file": "jadx-cli/src/main/java/jadx/cli/JadxAppCommon.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"291842413604998829570273132394799160824",
"113283694975340789859137919647751519218",
"223005181786662103813041763890169203814",
"78983018009067872244011050242975969531"
],
"threshold": 0.9
},
"id": "CVE-2026-42049-772d4178",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611",
"target": {
"file": "jadx-core/src/main/java/jadx/api/security/JadxSecurityFlag.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"5736702217203448160911817340749320683",
"269077785646012521731786671408228038098",
"3953160868942470855393178258042074071",
"188551915038047674829408929840110396690",
"131517842696909241639389535160613361823",
"42245641242978504235490296543860560253",
"178472222843071463863548907551404072356",
"53739902244554524102228090014202658236",
"60473314653212228304019795249243042774",
"106139324319150188113606844472403569240",
"224130890452049348364582500004724822315",
"69885341361157049444133976295266111488",
"100819430640495469907189178780807760188",
"137761797402991123048953293328933733008",
"270781668128168188475370440682003486792",
"305051532431313851290325627427678218011",
"185937906041434618384040976922188598707",
"335195243482548404177737447753117247857",
"45596785230582527776253380764489428756",
"35608109344293713455624946810244775007",
"167909917521723817509373665209773787713",
"108317699187406803922663006781390905372",
"185725755161440912773454460869241499091",
"335669082792515419439689658568662845398",
"287886255874223762689833474034932762231"
],
"threshold": 0.9
},
"id": "CVE-2026-42049-84244dec",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611",
"target": {
"file": "jadx-core/src/main/java/jadx/core/export/TemplateFile.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "195026456373462412173730696681505867856",
"length": 202
},
"id": "CVE-2026-42049-8e27ab1c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611",
"target": {
"file": "jadx-core/src/main/java/jadx/core/export/TemplateFile.java",
"function": "processVar"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"35296383378740507806186629837837755854",
"20728610398563277131024538025233690889",
"228395876099640181687101785253008253681",
"296775288296390487654547713451006010434",
"263578867129224240214967830231569765032",
"167030040373834431943690308768171913182",
"330403257613805298443926165337355773598",
"253292691156016515512251825854210042510",
"166132038710371337070642381827730998860",
"891996571536406465834636895654529905",
"108659887538657162577655635730828953433",
"185756869575263370306924456355459569235"
],
"threshold": 0.9
},
"id": "CVE-2026-42049-d1f642c5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611",
"target": {
"file": "jadx-core/src/main/java/jadx/api/security/impl/JadxSecurity.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "119991754765892574135646701889859547022",
"length": 922
},
"id": "CVE-2026-42049-db47ea80",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611",
"target": {
"file": "jadx-core/src/main/java/jadx/core/export/TemplateFile.java",
"function": "process"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "39401966052726628213303447894009379497",
"length": 179
},
"id": "CVE-2026-42049-e6286c59",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/skylot/jadx/commit/5a6e660b4663d998d52c7dc4511299f3368ef611",
"target": {
"file": "jadx-core/src/main/java/jadx/core/export/gen/SimpleJavaGradleGenerator.java",
"function": "saveBuildGradle"
}
}
]
vanir_signatures_modified
"2026-08-12T16:25:12Z"