CVE-2026-68928 Details
Description
Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.rk.exec.terminal.TerminalService is declared as an exported service in src/plugins/terminal/plugin.xml without a binding permission, and src/plugins/terminal/src/android/TerminalService.java does not verify the caller. Any installed Android application can bind the service and send MSG_EXEC with an attacker-controlled cmd value, which the terminal implementation passes to ProcessBuilder with sh -c inside Acode's UID. This allows a zero-permission local application to execute commands with access to Acode private data, remote credentials, Storage Access Framework grants, and runtime permissions without additional interaction at attack time. This issue is fixed in version 1.12.7.
A vulnerability in Acode, a text and code editor for Android, allows any installed application to execute arbitrary shell commands as Acode's user ID. This issue arises from the 'TerminalService', which is exported without a binding permission and lacks caller verification. The vulnerability is present in Acode versions 1.11.6 prior to 1.12.7. Exploitation of this vulnerability enables a zero-permission local application to access Acode's private data, remote credentials, Storage Access Framework grants, and runtime permissions, all without user interaction at the time of the attack.
The vulnerability has been fixed in Acode version 1.12.7 by setting the 'TerminalService' export attribute to false. For versions prior to 1.12.7, the service should not be exported or, if cross-process access is necessary, it should be guarded with a custom permission and caller verification.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Acode-Foundation/Acode/security/advisories/GHSA-wm94-wp33-43gx | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Acode-Foundation/Acode/commit/0a5237a3b140562dac877868137a784d6531894d | [email protected] | Source CodeVendor |
| https://github.com/Acode-Foundation/Acode/pull/2442 | [email protected] | Issue TrackingVendor |
| https://github.com/Acode-Foundation/Acode/releases/tag/v1.12.7 | [email protected] | Release NotesVendor |
| https://github.com/Acode-Foundation/Acode/security/advisories/GHSA-wm94-wp33-43gx | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-749 | Exposed Dangerous Method or Function | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
| CWE-926 | Improper Export of Android Application Components | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Acode-Foundation Acode | >= 1.11.6, <= 1.12.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | New CVE Received | [email protected] |