Voki Bot: Improper export of ShortcutDispatchActivity allows unauthorized automation replay
Summary
Voki Bot for Android (net.canvoki.vokibot) exports the ShortcutDispatchActivity component without a permission check. A malicious app on the same device can start it with a known trigger ID and make Voki Bot execute the user's configured automations, for example launching system settings. The attacker needs no permissions and no user interaction, but the trigger and automation must already exist in the victim's app data.
Affected
- Voki Bot (net.canvoki.vokibot) for Android, versionCode 14
- Other versions: Unknown.
Fixed in
- Unknown. No fixed version has been confirmed by the vendor or the advisory.
Workaround
- No vendor workaround found.
- Uninstall Voki Bot on devices where it is not needed.
- Review the automations and shortcuts configured in the app.
Exploitation
- Reporter-verified proof of concept exists in the advisory (emulator test, Android 13).
- No evidence of exploitation in the wild; not listed in CISA KEV.
- CISA SSVC: exploitation PoC, automatable yes, technical impact total.
Our recommendation
- Identify devices with Voki Bot installed and record their versionCode.
- Uninstall the app where it is not needed.
- Check the GitHub advisory and F-Droid for a fixed version and update once confirmed.
- Monitor NVD and the GitHub advisory for changes, as the NVD status is still Deferred.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- F-Droid: Voki Bot f-droid.org
- GitHub advisory CVE-2026-107017 github.com
- Voki Bot source code github.com
- VulDB entry 428466 vuldb.com
- OffSeq radar entry radar.offseq.com
- Voki Bot issue 14 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:14.
Original description (NVD)
Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to arbitrarily trigger another user's configured automated actions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.