Improper Restriction of XML External Entity Reference in skylot/jadx

MEDIO 5.5CVE-2022-0219 · GHSA-r8j4-96mx-rjcc · Published 20/01/2022 · updated 17/06/2026

In breve

CVE-2022-0219 è una vulnerabilità MEDIO (CVSS 5.5) che riguarda io.github.skylot:jadx-core, jadx (jadx project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.1%, superiore al 64.5% delle vulnerabilità.
Correzione: aggiornare a 1.3.2 o successiva.

Package	Affected versions	Patched versions
io.github.skylot:jadx-core Maven	`< 1.3.2`	`1.3.2`
jadx jadx_project	`< 1.3.2`	`1.3.2`

Description

skylot/jadx prior to 1.3.2 is vulnerable to Improper Restriction of XML External Entities when a user is tricked into exporting a malicious APK file (via the -e option) containing a crafted AndroidManifest.xml / strings.xml to gradle, leading to possible local file disclosure.

NVD description

Improper Restriction of XML External Entity Reference in GitHub repository skylot/jadx prior to 1.3.2.

References

nvd.nist.gov/vuln/detail/CVE-2022-0219 · ADVISORY
skylot/jadx commit d22db30 · WEB
skylot/jadx · PACKAGE
huntr.dev/bounties/0d093863-29e8-4dd7-a885-64f76d50bf5e · WEB

Altre vulnerabilità di io.github.skylot:jadx-core

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free