CVE-2026-68928: Acode: Exported TerminalService (bundled terminal plugin) lets any installed app execute arbitrary shell commands as Acode
Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.rk.exec.terminal.TerminalService is declared as an exported service in src/plugins/terminal/plugin.xml without a binding permission, and src/plugins/terminal/src/android/TerminalService.java does not verify the caller. Any installed Android application can bind the service and send MSGEXEC with an attacker-controlled cmd value, which the terminal implementation passes to ProcessBuilder with sh -c inside Acode's UID. This allows a zero-permission local application to execute commands with access to Acode private data, remote credentials, Storage Access Framework grants, and runtime permissions without additional interaction at attack time. This issue is fixed in version 1.12.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Acode (com.foxdebug.acode.rk.exec.terminal.TerminalService)to a version that resolves this vulnerability.Fixed in 1.12.7
Event History
Frequently Asked Questions
Which devices are exposed?
Devices running Acode versions from 1.11.6 up to, but not including, 1.12.7 are affected. Exploitation requires another application to be installed on the same Android device.
Does an attacker need Android permissions or user interaction to exploit this?
No. A zero-permission local app can bind to the exported service and submit an attacker-controlled command; no additional user interaction is required at attack time.
What access could a malicious app gain through exploitation?
Commands execute under Acode's UID, allowing access to Acode private data, remote credentials, Storage Access Framework grants, and permissions that Acode holds at runtime.
How can I remediate the issue?
Update Acode to version 1.12.7, which contains the fix. Until updating is possible, removing Acode prevents its exported terminal service from being used by another installed app.