Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2022-0219: GitHub jadx repository allows malicious XML files to be executed
CVE-2022-0219 · published 4 years ago
Summary
A flaw in the GitHub repository jadx allows attackers to execute malicious XML files. This could lead to unauthorized access to sensitive data or system compromise. Update jadx to version 1.3.2 or later to fix the issue.
What to do
- Update github io.github.skylot:jadx-core to version 1.3.2.
- Update jadx_project jadx to version 1.3.2 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | github | io.github.skylot:jadx-core |
< 1.3.2 Fix: upgrade to 1.3.2
|
| – | jadx_project | jadx |
< 1.3.2 cpe:2.3:a:jadx_project:jadx:*:*:*:*:*:*:*:* |
Original advisory text
Improper Restriction of XML External Entity Reference in skylot/jadx
Improper Restriction of XML External Entity Reference in GitHub repository skylot/jadx prior to 1.3.2.
References
- https://huntr.dev/bounties/0d093863-29e8-4dd7-a885-64f76d50bf5e URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0219.j... Vendor Advisory
- https://github.com/advisories/GHSA-r8j4-96mx-rjcc
- https://nvd.nist.gov/vuln/detail/CVE-2022-0219 Vendor Advisory
- https://github.com/skylot/jadx/commit/d22db30166e7cb369d72be41382bb63ac8b81c52 Patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-611XML External Entity (XXE)
Timeline
Published20 Jan 2022
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta