The jadx decompiler allows a malicious Android application to inject Groovy code into the Gradle build script that is generated when a user exports a decompiled APK as a Gradle project. Because the versionName value is placed into the Groovy template without sanitization, an attacker can break out of the string context and have arbitrary code executed on the machine that opens or builds the exported project. This is a remote code execution flaw that can compromise the confidentiality, integrity, and availability of the victim system. The weakness is a classic code‑injection vulnerability (CWE‑94).

The flaw exists in the open‑source jadx decompiler from skylot. Versions prior to 1.5.6 are affected by the injection issue when exporting using the Gradle project feature. jadx 1.5.6 and later contain the fix.

The CVSS base score of 8.4 signals high severity. The EPSS score of less than 1 % indicates a very low probability of exploitation in current real‑world usage, though knowledge of the flaw remains. Because the vulnerability requires a malicious APK to be supplied to jadx and the victim to open the resulting Gradle project, it is essentially a local or convenience‑based attack rather than a widespread remote exploit. The flaw is not listed in the CISA KEV catalog, but administrators should treat it as a high‑priority issue and apply the vendor‑supplied patch promptly.