The flaw is in the Summary tab where SummaryNode.java concatenates archive and architecture count values extracted from APK .so file paths into an HTML panel without escaping. An attacker can embed percent‑encoded ZIP filenames that become part of the HTML, forcing the GUI to render arbitrary markup. This can trigger out‑of‑band network requests, reveal the user’s IP address, or interact with locally exposed applications.

The issue exists in all versions of the open‑source decompiler jadx from skylot before 1.5.6. Users running any release up to 1.5.5 and accessing the Summary view are affected.

The CVSS score of 3.6 indicates lowSS score of less than 1% implies a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to execute JADX GUI with a malicious APK; remote exploitation is not possible unless the attacker can run the GUI on the target machine.