jadx, a Dex‑to‑Java decompiler, improperly handles entry names in XAPK archives between releases 1.5.2 and 1.5.5, allowing a malicious file to write content outside the intended temporary unpack directory. This path traversal (CWE‑22) can plant a JAR in the plugins/dropins folder so that the next jadx execution, resulting in local code execution within the jadx environment. All builds in the 1.5.2 through 1.5.5 range are vulnerable; the issue is resolved in release 1.5.6.

The affected product is jadx, the open‑source Dex‑to‑Java decompiler by skylot. Versions 1.5.2 through 1.5.5 are vulnerable; all other releases are not affected. The vulnerability is specific to the XAPK archive handling functionality where malicious entry names can escape the intended temporary unpack directory. No other products or versions are listed as impacted.

The CVSS score of 7 indicates high severity, but the EPSS score of less than 1 percent shows a low likelihood of exploitation in the wild, and it is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a crafted XAPK file and trigger the configuration path. The attack vector is local: it does not provide remote code execution from the network and is limited to environments where the attacker can control file creation and program execution.