Acode
Monthly
Command injection within Acode on Android lets any locally installed application execute arbitrary shell commands inside Acode's own sandboxed UID, exposing private app data, stored remote credentials, Storage Access Framework grants and granted runtime permissions. The flaw affects builds from 1.11.6 up to but not including 1.12.7, where the terminal plugin exports com.foxdebug.acode.rk.exec.terminal.TerminalService without a binding permission and TerminalService.java performs no caller verification, so a zero-permission hostile app can bind the service and pass an attacker-controlled cmd value via MSG_EXEC. Exploitation is strictly local and requires the victim to already have run a malicious app alongside a vulnerable Acode release; no public exploit code has been identified at time of analysis and there is no CISA KEV listing or EPSS signal reported.
Command injection within Acode on Android lets any locally installed application execute arbitrary shell commands inside Acode's own sandboxed UID, exposing private app data, stored remote credentials, Storage Access Framework grants and granted runtime permissions. The flaw affects builds from 1.11.6 up to but not including 1.12.7, where the terminal plugin exports com.foxdebug.acode.rk.exec.terminal.TerminalService without a binding permission and TerminalService.java performs no caller verification, so a zero-permission hostile app can bind the service and pass an attacker-controlled cmd value via MSG_EXEC. Exploitation is strictly local and requires the victim to already have run a malicious app alongside a vulnerable Acode release; no public exploit code has been identified at time of analysis and there is no CISA KEV listing or EPSS signal reported.