The Acode text editor for Android contains a critical vulnerability where an improperly exported service allows local applications to execute arbitrary commands with elevated application-level permissions.

This vulnerability involves an exposed Android service (TerminalService) that lacks proper caller verification and binding permissions. An unauthenticated local attacker can interact with this service to inject commands into the ProcessBuilder, leading to arbitrary code execution within the Acode application's security context.

Successful exploitation allows a malicious local application to bypass Android sandbox restrictions and access Acode private data, remote credentials, and Storage Access Framework grants. Given the CVSS score of 8.6, this vulnerability poses a high risk of sensitive data theft and unauthorized control over the application's runtime environment, potentially impacting user privacy and organizational security posture.

Immediate Action: Update the Acode application to version 1.12.7 or later to implement the necessary security controls for the TerminalService.

Proactive Monitoring: Review Android device logs for unexpected interactions with the TerminalService component or unauthorized attempts to leverage the application's internal API.

Compensating Controls: Ensure all applications installed on managed Android devices are sourced from trusted repositories and utilize mobile device management (MDM) policies to restrict potentially malicious app installation.

Public Exploit Available: No

This vulnerability represents a significant security oversight in the Acode application's component architecture, granting excessive power to local actors. Organizations should prioritize updating all instances of Acode to version 1.12.7 immediately to prevent potential exploitation and ensure that the application's internal services are properly protected from unauthorized access.