Skip to content

jadx

v1.5.6 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 3 known CVEs

Topics

android decompiler dex java

Affected surfaces

rce_ssrf deps

Summary

AI summary

Updates Bug Fixes, New Contributors, and All changes across a mixed release.

Full changelog

Main features and fixes

Security fixes:

  • Reject absolute or path to CWD for zip entries
  • Sanitize all string values for gradle scripts on export
  • Add missing escaping on summary page

Core:

  • Use queue instead of recursion for type updates

GUI:

  • Graph views, code pane sync, and more (PR #2784)
  • Collapse single-child directory chains in resource tree (PR #2866)
  • Handle pasted file lists in file chooser (PR #2876)
  • Show simple message box for file exceptions (#2659)

API:

  • Allow to create input category node even if no matching files found (#2806)
  • New module/library for work with call graphs (#2890)

All changes

Click to expand

Features

  • [core] Graph views, code pane sync, and more (PR #2784)
  • [core] Use queue instead of recursion for type updates
  • [core] New module/library for work with call graphs (#2890)
  • [gui] Add mimetype for desktop file
  • [gui] Open single loaded class after load
  • [gui] Add "copy reference" to context menu (PR #2863)
  • [gui] Collapse single-child directory chains in resource tree (PR #2866)
  • [gui] Handle pasted file lists in file chooser (PR #2876)
  • [gui] Show simple message box for file exceptions (#2659)

Bug Fixes

  • [core] Insert generic casts for variable assigned from fields with known types (#2776)
  • [core] Handle Kotlin 1.9+ $ENTRIES pattern in enum restoration (PR #2814)
  • [core] Remove useless PHI for duplicate moves (#2813)
  • [core] Support enum restore for constructor without args (#2821)
  • [core] Handle null bounds in WindowLocation to prevent NPE on dialog dispose (PR #2826)
  • [core] Stop type inference on exception (prevent endless loop)
  • [core] Resolve class/package name conflicts on case-insensitive filesystems (PR #2828)
  • [core] Use correct property for OS arch checks (#2830)
  • [core] Use correct args copy/replace in wrapped insns (#2835)
  • [core] Resolve minor decompilation issues (#2835)
  • [core] Remove result in wrapped insntructions (#2835)
  • [core] Limit ternary wrap to one level (#2844)
  • [core] Disable ternary mod for duplicated blocks (#2844)
  • [core] Harden XML parser in FileTypeDetector against XML bomb DoS (PR #2851)
  • [core] Improve handler path check for regions
  • [core] Limit 'if' region out block to current scope (#2791)
  • [core] Build correct file path for class from default package (#2854)
  • [core] Cover more situations for SwitchOverString (PR #2860)
  • [core] Workaround for duplicated variables names index increment (#2868)
  • [core] Resolve duplicated error attr in fallback codegen, allow to set whole attr list at once (#2842)
  • [core] Keep all dimensions for anewarray of an array element type (PR #2887)
  • [core] ImmutableList.lastIndexOf skipping index 0 (PR #2898)
  • [api] Allow to create input category node even if no matching files found (#2806)
  • [build] Set *nix executable permissions on start scripts (PR #2838)
  • [cli] In 'progress' log mode show issues from input plugins (#2803)
  • [gui] Update usage file data version (was changed in PR #2784)
  • [gui] Resolve possible NPE during project data loading (#2794)
  • [gui] Stop token process on NULL token in JadxTokenMaker (#2798)
  • [gui] Use UI thread for scroll in code (#2798)
  • [gui] Make the Split view checkbox correctly toggle between both modes (PR #2801)
  • [gui] Use UI thread for refreshStackFrameList in debugger view (PR #2807)
  • [gui] Use UI thread for adding logcat messages (#2811)
  • [gui] Update zh_CN translation (PR #2812)
  • [gui] Update zh_tw translation (PR #2818)
  • [gui] Move scripts leftover code, save tree state on script run
  • [gui] Resolve "launchScriptPath" is null
  • [gui] Localize code cache mode labels (PR #2825)
  • [gui] Use localized label for code cache preferences
  • [gui] Add file end line feed for exported code (PR #2836)
  • [gui] NullPointerException when changing line wrap mode (PR #2843)
  • [gui] Ensure all fonts are 'composite' (#2856)
  • [gui] Improve code tabs, sync and related code
  • [gui] Improve dot graph viewer, CFG generation simplified
  • [gui] Fix token type error leading to disables right-click context menu rename button (PR #2897)
  • [gui] Verify files and show fix actions, save project inputs hash on load (#2659)
  • [gui] Add missing escaping on summary page
  • [gui] Workaround for CJK support in bundled fonts (#2856)
  • [quark] Change from 'virtualenv' to 'venv' (PR #2879)
  • [res] Use safe number parsing for android manifest, refactor params object (#2857)
  • [script] Update imports in example scripts (#2795)
  • [xapk] Support files in sub-dirs in xapk (#2834)

New Contributors

  • @gordon-f0 made their first contribution in https://github.com/skylot/jadx/pull/2784
  • @HdShare made their first contribution in https://github.com/skylot/jadx/pull/2812
  • @obus-globus made their first contribution in https://github.com/skylot/jadx/pull/2814
  • @dartcv made their first contribution in https://github.com/skylot/jadx/pull/2818
  • @peasoft made their first contribution in https://github.com/skylot/jadx/pull/2824
  • @mango766 made their first contribution in https://github.com/skylot/jadx/pull/2826
  • @johnwas made their first contribution in https://github.com/skylot/jadx/pull/2828
  • @mbv06 made their first contribution in https://github.com/skylot/jadx/pull/2876
  • @paraeee made their first contribution in https://github.com/skylot/jadx/pull/2879
  • @vasiliy-mikhailov made their first contribution in https://github.com/skylot/jadx/pull/2898
  • @amirdeljouyi made their first contribution in https://github.com/skylot/jadx/pull/2901
  • @Plasion made their first contribution in https://github.com/skylot/jadx/pull/2897

Full Changelog: https://github.com/skylot/jadx/compare/v1.5.5...v1.5.6

Download files:

For system JRE the latest version is always preferred, download at oracle.com

Security Fixes

  • Reject absolute or CWD‑relative zip entry paths
  • Sanitize all string values in exported Gradle scripts
  • Hardened XML parser in FileTypeDetector against XML bomb DoS attacks (PR #2851)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track jadx

Get notified when new releases ship.

Sign up free

About jadx

Dex to Java decompiler

All releases →

Related context

Beta — feedback welcome: [email protected]