{"id":"CVE-2026-68928","summary":"Acode: Exported TerminalService (bundled terminal plugin) lets any installed app execute arbitrary shell commands as Acode","details":"Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.rk.exec.terminal.TerminalService is declared as an exported service in src/plugins/terminal/plugin.xml without a binding permission, and src/plugins/terminal/src/android/TerminalService.java does not verify the caller. Any installed Android application can bind the service and send MSG_EXEC with an attacker-controlled cmd value, which the terminal implementation passes to ProcessBuilder with sh -c inside Acode's UID. This allows a zero-permission local application to execute commands with access to Acode private data, remote credentials, Storage Access Framework grants, and runtime permissions without additional interaction at attack time. This issue is fixed in version 1.12.7.","aliases":["GHSA-wm94-wp33-43gx"],"modified":"2026-09-20T11:47:25.599820878Z","published":"2026-09-18T20:40:12.495Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-749","CWE-862","CWE-926"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68928.json"},"references":[{"type":"WEB","url":"https://github.com/Acode-Foundation/Acode/releases/tag/v1.12.7"},{"type":"ADVISORY","url":"https://github.com/Acode-Foundation/Acode/security/advisories/GHSA-wm94-wp33-43gx"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68928.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68928"},{"type":"FIX","url":"https://github.com/Acode-Foundation/Acode/commit/0a5237a3b140562dac877868137a784d6531894d"},{"type":"FIX","url":"https://github.com/Acode-Foundation/Acode/pull/2442"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/acode-foundation/acode","events":[{"introduced":"fd4b2c60d7031baea8e6a2c2d6336e7dc86c5cb6"},{"fixed":"0a5237a3b140562dac877868137a784d6531894d"},{"fixed":"bcda8f42f1b65be2ebaf7a2971ecc8b0d0ebc69e"}],"database_specific":{"extracted_events":[{"introduced":"1.11.6"},{"fixed":"1.12.7"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["1.12.6-nightly.6016e86","1.12.6-nightly.92f6bef","1.12.6-nightly.5110e1f","1.12.6-nightly.91de762","1.12.6-nightly.7c68ddd","1.12.6-nightly.a53fde3","1.12.6-nightly.2396d20","1.12.6-nightly.ba4c7d6","1.12.6-nightly.d79fdcf","1.12.6-nightly.55d1289","1.12.6-nightly.544ac4f","1.12.6-nightly.88ee3b9","1.12.6-nightly.16c4dee","1.12.6-nightly.c2c308a","1.12.6-nightly.095786c","1.12.6-nightly.771602c","1.12.6-nightly.f7969e8","1.12.6-nightly.8a9a6c3","1.12.6-nightly.4c30248","1.12.6-nightly.411f55b","1.12.6-nightly.e831b39","1.12.6-nightly.88cc16c","1.12.6-nightly.c9a4765","1.12.6-nightly.5ff7964","1.12.6-nightly.0a5237a","1.12.6-nightly.7255999","1.12.6-nightly.7767260","1.12.6-nightly.2f98c4f","1.12.6-nightly.aec0dfd","1.12.6-nightly.db4f81b","1.12.6-nightly.3fc82a6","1.12.6-nightly.7ebb3bb","1.12.6-nightly.a58814f","1.12.6-nightly.3420c70","1.12.6-nightly.b5ba27c","1.12.6-nightly.87e388d","1.12.6-nightly.25f86d7","1.12.6-nightly.29097c1","1.12.6-nightly.acc0f0a","v1.12.6","1.12.5-nightly.98ea35f","1.12.5-nightly.d2eb67e","1.12.5-nightly.4564be6","1.12.5-nightly.277099a","1.12.5-nightly.81ad2cf","v1.12.5","1.12.4-nightly.13f0890","1.12.4-nightly.09b15ba","v1.12.4","1.12.3-nightly.2e72623","v1.12.3","1.12.2-nightly.dbde879","1.12.2-nightly.ebbb804","1.12.2-nightly.5df5587","1.12.2-nightly.7b22622","1.12.2-nightly.ba8b138","1.12.2-nightly.b0e7fda","1.12.2-nightly.06ecfe9","1.12.2-nightly.76c831a","1.12.2-nightly.f9428af","1.12.2-nightly.eed06f9","1.12.2-nightly.b60058a","1.12.2-nightly.2616d45","1.12.2-nightly.e69c369","1.12.2-nightly.05625fc","1.12.2-nightly.957f17e","1.12.0-nightly.6cff253","1.12.0-nightly.fcf2ff0","1.12.0-nightly.11b88e4","1.12.0-nightly.8c9ebf8","1.12.0-nightly.81b8ff8","1.11.8-nightly.4c83d3f","1.11.8-nightly.b8b8e1e","1.11.8-nightly.6ffbe6c","1.11.8-nightly.50dc468","1.11.8-nightly.a028798","1.11.8-nightly.98ecd95","1.11.8-nightly.d4b19f1","1.11.8-nightly.fa02c4d","1.11.8-nightly.0455f86","1.11.8-nightly.9051211","1.11.8-nightly.1a2f629","1.11.8-nightly.773d572","1.11.8-nightly.d3219ea","1.11.8-nightly.d97ce3c","1.11.8-nightly.2ef5d86","1.11.8-nightly.6121291","1.11.8-nightly.9a041e3","1.11.8-nightly.c4469e7","1.11.8-nightly.8381c1f","1.11.8-nightly.2fbf95d","1.11.8-nightly.76d297d","1.11.8-nightly.0006340","1.11.8-nightly.b6ae63c","1.11.8-nightly.31b8cc9","1.11.8-nightly.0459064","1.11.8-nightly.50a125b","1.11.8-nightly.3f753cd","1.11.8-nightly.767907e","1.11.8-nightly.e04f4d2","1.11.8-nightly.228a339","1.11.8-nightly.25bdf3a","1.11.8-nightly.19c555f","1.11.8-nightly.69c0803","1.11.8-nightly.61aca01","1.11.8-nightly.fd0e833","1.11.8-nightly.d2efece","1.11.8-nightly.149a99b","1.11.8-nightly.8704e6e","1.11.8-nightly.f5ede09","1.11.8-nightly.eef6d0a","1.11.8-nightly.645c353","1.11.8-nightly.0835d63","1.11.8-nightly.cd1efaa","1.11.8-nightly.47fe9bc","1.11.8-nightly.d144a65","1.11.8-nightly.8f93334","1.11.8-nightly.0470cf7","1.11.8-nightly.d79a906","1.11.8-nightly.6b24251","1.11.8-nightly.eb97e60","1.11.8-nightly.d0ca77e","1.11.8-nightly.7b5861b","1.11.8-nightly.0f00ed9","1.11.8-nightly.edee414","1.11.8-nightly.8473a88","1.11.8-nightly.10ee055","1.11.8-nightly.533c1ac","1.11.8-nightly.3ef0246","1.11.8-nightly.c2f6644","1.11.8-nightly.df79e64","1.11.8-nightly.c77b117","1.11.8-nightly.67dfb05","1.11.8-nightly.68a7166","1.11.8-nightly.055c51a","1.11.8-nightly.4158d37","1.11.8-nightly.67776d4","1.11.8-nightly.d12ad65","1.11.8-nightly.3d0b714","1.11.8-nightly.4266e36","1.11.8-nightly.b9db8e9","v1.11.8","1.11.8-nightly.e2acb9b","1.11.7-nightly.3b81aec","1.11.7-nightly.606c98d","1.11.7-nightly.ebb8830","1.11.7-nightly.c3754b2","1.11.7-nightly.15955ad","1.11.7-nightly.bdbf86b","1.11.7-nightly.72cedfd","1.11.7-nightly.e13df1d","1.11.7-nightly.0284b2c","1.11.7-nightly.b82d3f7","1.11.7-nightly.68291d5","1.11.7-nightly.eb169fa","1.11.7-nightly.6750d9c","1.11.7-nightly.019c73c","1.11.7-nightly.ca86bfe","1.11.7-nightly.32a2838","1.11.7-nightly.715d50d","1.11.7-nightly.05a1b5d","1.11.7-nightly.eee8475","1.11.7-nightly.7fd0e1e","1.11.7-nightly.1207f64","1.11.7-nightly.b6f1a3f","v1.11.8-beta","1.11.7-nightly.9fe1ec8","1.11.7-nightly.ed4c753","1.11.7-nightly.3c05d8a","1.11.7-nightly.f302451","1.11.7-nightly.0d2199f","1.11.7-nightly.b687005","1.11.7-nightly.a709ae0","1.11.7-nightly.45d286f","1.11.7-nightly.d5b2ec9","1.11.7-nightly.5f70dee","1.11.7-nightly.c49f403","1.11.7-nightly.3419adf","1.11.7-nightly.b724720","1.11.7-nightly.ef36994","1.11.7-nightly.572944a","v1.11.7","1.11.7-nightly.1a0d5ea","1.11.6-nightly.7ccfc23","1.11.6-nightly.ae6ff18","1.11.6-nightly.f3814ae","1.11.6-nightly.8d1b5a6","1.11.6-nightly.d20f1b3","1.11.6-nightly.4fd5410","1.11.6-nightly.00856fc","1.11.6-nightly.5680883","1.11.6-nightly.d3413f7","1.11.6-nightly.626c5fe","1.11.6-nightly.78e0f4a","1.11.6-nightly.9a55d5c","1.11.6-nightly.2e2e93c","1.11.6-nightly.d17459d","v1.11.7-beta.2","1.11.6-nightly.54b06e7","1.11.6-nightly.6c8ab56","1.11.6-nightly.5ad3009","1.11.6-nightly.cdeda55","1.11.6-nightly.82c0999","1.11.6-nightly.c0f2971","1.11.6-nightly.cec8fba","1.11.6-nightly.7526337","1.11.6-nightly.64b3568","1.11.6-nightly.2b5ebcf","1.11.6-nightly.d211cf2","1.11.6-nightly.e269ba1","1.11.6-nightly.3458718","1.11.6-nightly.ea2ba69","1.11.6-nightly.fc84e79","1.11.7-beta","v1.11.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68928.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}]}