CVE-2024-32653

MEDIUM

jadx < 1.5.0 - Remote Code Execution via Package Name Injection

Title source: llm

Description

jadx is a Dex to Java decompiler. Prior to version 1.5.0, the package name is not filtered before concatenation. This can be exploited to inject arbitrary code into the package name. The vulnerability allows an attacker to execute commands with shell privileges. Version 1.5.0 contains a patch for the vulnerability.

References (3)

Core 3

Core References

Release Notes x_refsource_misc

https://github.com/skylot/jadx/releases/tag/v1.5.0

Vendor Advisory x_refsource_confirm

https://github.com/skylot/jadx/security/advisories/GHSA-3pp3-hg2q-9gpm

Various Sources x_refsource_misc

https://github.com/skylot/jadx/blob/9114821fb12558874e01421bf38b0d34fb39df72/jadx-gui/src/main/java/jadx/gui/device/protocol/ADBDevice.java#L108-L109

View Writeup ZIP pw:eip

Scores

CVSS v3 6.1

EPSS 0.0024

EPSS Percentile 14.5%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-20

Status published

Products (1)

skylot/jadx < 1.5.0

Published Apr 22, 2024

Tracked Since Feb 18, 2026