CVE-2022-0219: Improper Restriction of XML External Entity Reference in skylot/jadx
Summary
CVE-2022-0219: Improper Restriction of XML External Entity Reference in skylot/jadx. Affects io.github.skylot:jadx-core versions < 1.3.2. Fixed in 1.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The skylot/jadx package is a Java-based decompiler for Android applications. It allows users to decompile APK files and extract their source code. This package is commonly used by developers and security researchers to analyze Android applications. However, prior to version 1.3.2, skylot/jadx is vulnerable to an improper restriction of XML external entities (XXE) issue.
Vulnerability Detail
The vulnerability arises when a user is tricked into exporting a malicious APK file using the -e option in skylot/jadx. The exported APK file contains a crafted AndroidManifest.xml / strings.xml file that triggers the XXE vulnerability when processed by gradle. This can lead to possible local file disclosure, allowing an attacker to access sensitive files on the system. The vulnerability has a CVSS score of 5.5, indicating a moderate severity level.
How To Fix
Latest published version: 1.5.6 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the latest version of skylot/jadx to mitigate the risk.
Conclusion
The skylot/jadx package prior to version 1.3.2 is vulnerable to an XXE issue that can lead to local file disclosure. Users should update to version 1.3.2 or later to fix the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.github.skylot:jadx-core →
FAQ
skylot/jadx is a Java-based decompiler for Android applications. It allows users to decompile APK files and extract their source code.
An XML External Entity (XXE) vulnerability occurs when an XML parser processes external entities defined in the XML document. This can lead to various security issues, including information disclosure and denial of service.
An attacker can exploit this vulnerability by tricking a user into exporting a malicious APK file containing a crafted AndroidManifest.xml / strings.xml file. When the file is processed by gradle, the XXE vulnerability is triggered, potentially leading to local file disclosure.
The vulnerability can allow an attacker to access sensitive files on the system, leading to potential information disclosure. However, exploitation of this vulnerability requires the user to export and process a malicious APK file.
Yes, updating the skylot/jadx package to version 1.3.2 or later will fix the vulnerability. It is recommended to update as soon as possible to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for io.github.skylot:jadx-core.
