{"id":"CVE-2026-107057","kind":"vulnerability","aliases":["CVE-2026-107057"],"related":[],"title":"AndBible: crafted module zip upload lets attackers run arbitrary code","description":"An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip.","summary":"AndBible versionCode 1111 accepts a crafted module zip file that can make the app execute arbitrary code. An attacker who gets a user to load such a module can run code on the device with the app's permissions.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["andbible","android","package"],"not_affected_if":["no-module-import","other-versions"],"how_to_check":"- Check the installed AndBible version in the app's About screen or build metadata; versionCode 1111 is affected.","fix":null,"status":"open","published_at":"2026-10-29T17:17:58+00:00","first_seen_at":"2026-10-29T17:26:16+00:00","triaged_at":"2026-10-29T17:28:03+00:00","updated_at":"2026-10-29T17:28:03+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T17:28:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"AndBible: crafted module zip upload lets attackers run arbitrary code","impact":"high","summary":"AndBible versionCode 1111 accepts a crafted module zip file that can make the app execute arbitrary code. An attacker who gets a user to load such a module can run code on the device with the app's permissions.","audience":"everyone","category":"package","nicknames":[],"who_cares":["andbible","android"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker code runs inside the app on the user's device.","analyst_note":"Confirm the exact attack path (module import, file handling) and whether a fixed AndBible version exists; check the NVD entry and the AndBible project repository.","how_to_check":"- Check the installed AndBible version in the app's About screen or build metadata; versionCode 1111 is affected.\n- unknown","plain_action":"If you use the AndBible Bible app, check its version and update it once a fixed release is published; avoid loading unknown module zip files until then.","needs_analyst":true,"not_affected_if":["other-versions","no-module-import"],"who_is_affected":"Users of the AndBible Android Bible app at versionCode 1111 who import module zip files, especially from untrusted sources. The sources do not describe the exact import path or whether any other configuration is needed.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00066,"input_tokens":4063,"output_tokens":507,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107057':13A,16A '-2026':12A,15A '1111':22B,64C 'accept':23B 'allow':65C 'andbibl':1A,17B,20B,62C 'android':18B 'app':33B,56B 'arbitrari':9A,35B,69C 'attack':7A,38B,66C 'code':10A,36B,50B,70C 'craft':2A,25B,74C 'cve':11A,14A 'devic':53B 'execut':34B,68C 'file':28B 'get':40B 'issu':60C 'let':6A 'load':44B 'make':31B 'modul':3A,26B,47B,75C 'packag':19B 'permiss':58B 'run':8A,49B 'upload':5A,72C 'user':42B 'versioncod':21B,63C 'via':71C 'zip':4A,27B,76C","nicknames":[],"mitigations":[],"who_affected":"Users of the AndBible Android Bible app at versionCode 1111 who import module zip files, especially from untrusted sources. The sources do not describe the exact import path or whether any other configuration is needed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you use the AndBible Bible app, check its version and update it once a fixed release is published; avoid loading unknown module zip files until then.","first_public_at":"2026-10-29T17:17:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107057","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107057","severity":null,"published_at":"2026-10-29T17:17:58+00:00","modified_at":"2026-10-29T17:17:58+00:00","first_seen_at":"2026-10-29T17:26:16+00:00","fetched_at":"2026-10-29T17:26:16+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}