EUVD-2026-83444Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Local co-resident app with no Acode privileges (AV:L/PR:N), trivially reliable (AC:L); binding the exported service escapes the attacker app's sandbox into Acode's UID (S:C) yielding full C/I/A over Acode's data.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
7DescriptionCVE.org
Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.rk.exec.terminal.TerminalService is declared as an exported service in src/plugins/terminal/plugin.xml without a binding permission, and src/plugins/terminal/src/android/TerminalService.java does not verify the caller. Any installed Android application can bind the service and send MSG_EXEC with an attacker-controlled cmd value, which the terminal implementation passes to ProcessBuilder with sh -c inside Acode's UID. This allows a zero-permission local application to execute commands with access to Acode private data, remote credentials, Storage Access Framework grants, and runtime permissions without additional interaction at attack time. This issue is fixed in version 1.12.7.
Articles & Coverage 1
AnalysisAI
Command injection within Acode on Android lets any locally installed application execute arbitrary shell commands inside Acode's own sandboxed UID, exposing private app data, stored remote credentials, Storage Access Framework grants and granted runtime permissions. The flaw affects builds from 1.11.6 up to but not including 1.12.7, where the terminal plugin exports com.foxdebug.acode.rk.exec.terminal.TerminalService without a binding permission and TerminalService.java performs no caller verification, so a zero-permission hostile app can bind the service and pass an attacker-controlled cmd value via MSG_EXEC. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a second, attacker-controlled Android application already installed on the same device as a vulnerable Acode build (1.11.6 through 1.12.6); that app needs NO Android permissions of its own. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a legitimately high-priority local privilege/data-exposure flaw despite no EPSS, KEV, or public POC being present. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Acode to version 1.12.7 or later (vendor-released patch), which sets android:exported="false" on TerminalService as shown in upstream pull request 2442 and commit 0a5237a3b140562dac877868137a784d6531894d; the fix is distributed through the v1.12.7 release at https://github.com/Acode-Foundation/Acode/releases/tag/v1.12.7 and Google Play, and the vendor advisory is GHSA-wm94-wp33-43gx. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Android devices for Acode installations, focusing on versions 1.11.6 through 1.12.6, and instruct users to uninstall Acode unless it is business-critical. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-749 – Exposed Dangerous Method or Function
View allShare
External POC / Exploit Code
Leaving vuln.today