A flaw in the WebView rendering path of MotionCreative Motion UI versionCode 101 allows an attacker who can supply a crafted POST request to execute arbitrary code. This vulnerability is a direct code execution flaw that could compromise the integrity and confidentiality of the device and any data handled by the application, and could potentially allow persistence or further attacks once inside the runtime. The weakness appears to stem from insufficient validation of POST content sent to the WebView component.

The affected product is MotionCreative Motion UI, version 101, available as an Android application. It is distributed through the F‑Droid repository and hosted on the MotionUI GitHub project. No other vendors or versions are listed as affected, indicating that only this exact build is known to contain the flaw.

The CVSS scale is not provided and no EPSS score is available, making it difficult to quantify the likelihood of exploitation. The vulnerability has not been reported in the CISA KEV catalogue, further suggesting limited real‑world exploitation to date. Based on the description, the likely attack vector involves an attacker sending a specially crafted POST request to the vulnerable WebView path, which could be performed from within the app or via a remote user if the component exposes an external interface. The lack of a public fix at this time increases the urgency of applying any available update or mitigation.