{"id":"CVE-2026-107048","kind":"vulnerability","aliases":["CVE-2026-107048"],"related":[],"title":"MotionCreative Motion UI: crafted POST request lets attackers run arbitrary code","description":"An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request.","summary":"A flaw in the WebView rendering path of MotionCreative Motion UI, version code 101, lets an attacker execute arbitrary code by sending a crafted POST request. The sources give no further detail on the affected platform or how the request is processed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["motion-ui","other","webview"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-29T17:17:57+00:00","first_seen_at":"2026-10-29T17:26:16+00:00","triaged_at":"2026-10-29T17:28:10+00:00","updated_at":"2026-10-29T17:28:10+00:00","category":"other","confidence":0.3,"triage":{"at":"2026-10-29T17:28:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MotionCreative Motion UI: crafted POST request lets attackers run arbitrary code","impact":"high","summary":"A flaw in the WebView rendering path of MotionCreative Motion UI, version code 101, lets an attacker execute arbitrary code by sending a crafted POST request. The sources give no further detail on the affected platform or how the request is processed.","audience":"businesses","category":"other","nicknames":[],"who_cares":["motion-ui","webview"],"confidence":0.3,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the affected component","analyst_note":"Find the vendor advisory or a detailed write-up for MotionCreative Motion UI versionCode 101 to confirm the product, platform, and fixed version.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources name only MotionCreative Motion UI versionCode 101 and a WebView rendering path; they do not say which deployments use it or what configuration exposes it. Teams that run Motion UI builds at that version should look for them, but the sources do not establish the exposed surface.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000641,"input_tokens":4077,"output_tokens":466,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107048':14A,17A '-2026':13A,16A '101':36B,78C 'affect':57B 'allow':79C 'arbitrari':10A,41B,83C 'attack':8A,39B,80C 'code':11A,35B,42B,84C 'compon':72C 'craft':4A,46B,88C 'cve':12A,15A 'detail':54B 'execut':40B,82C 'flaw':24B 'give':51B 'issu':66C 'let':7A,37B 'motion':2A,19B,32B,75C 'motion-ui':18B 'motioncr':1A,31B,74C 'path':29B,71C 'platform':58B 'post':5A,47B,89C 'process':64B 'render':28B,70C 'request':6A,48B,62B,90C 'run':9A 'send':44B 'sourc':50B 'suppli':86C 'ui':3A,20B,33B,76C 'version':34B 'versioncod':77C 'via':85C 'webview':22B,27B,69C","nicknames":[],"mitigations":[],"who_affected":"The sources name only MotionCreative Motion UI versionCode 101 and a WebView rendering path; they do not say which deployments use it or what configuration exposes it. Teams that run Motion UI builds at that version should look for them, but the sources do not establish the exposed surface.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T17:17:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107048","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107048","severity":null,"published_at":"2026-10-29T17:17:57+00:00","modified_at":"2026-10-29T17:17:57+00:00","first_seen_at":"2026-10-29T17:26:16+00:00","fetched_at":"2026-10-29T17:26:16+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}