The AndBible Android application offers a module system that accepts ZIP files to extend its functionality. In build 1111 a flaw allows an attacker to create a specially crafted ZIP; when displayed by the app it triggers the execution of arbitrary code, giving an attacker full control of the application’s runtime.

The flaw exists only in the AndBible client with versionCode 1111, distributed through F‑Droid and GitHub. Any device running that specific build and allowing arbitrary module imports is affected. The code is open source, making the vulnerability public.

No exploitation evidence is publicly reported, and the vulnerability is not listed in CISA’s KEV catalog. The EPSS measurement is unavailable, so current exploit probability cannot be quantified. Nevertheless, the potential for remote code execution is grave; an attacker would need to supply a crafted ZIP to a device running the vulnerable app. The exact conditions under which the app loads such modules are not publicly documented, and it is unclear whether automatic loading would occur without explicit user interaction. Proactive remediation is therefore advised.