What’s Vulnerable › Vulnerabilities

CVE-2021-21386: Improper Neutralization of Argument Delimiters in a Decompiling Package Process

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-03-24 · updated 2026-06-17
• Weakness: CWE-78

Description

APKLeaks is an open-source project for scanning APK file for URIs, endpoints & secrets. APKLeaks prior to v2.0.3 allows remote attackers to execute arbitrary OS commands via package name inside application manifest. An attacker could include arguments that allow unintended commands or code to be executed, allow sensitive data to be read or modified or could cause other unintended behavior through malicious package name. The problem is fixed in version v2.0.6-dev and above.

Affected products

• dwisiswant0 apkleaks: before 2.0.3 — fixed in 2.0.3

How to fix

Upgrade to a fixed version: dwisiswant0 apkleaks 2.0.3. Check the vendor advisory for mitigations.

References

• https://github.com/dwisiswant0/apkleaks/commit/a966e781499ff6fd4eea66876d7532301b13a382
• https://github.com/dwisiswant0/apkleaks/security/advisories/GHSA-8434-v7xw-8m9x
• https://github.com/dwisiswant0/apkleaks/commit/a966e781499ff6fd4eea66876d7532301b13a382
• https://github.com/dwisiswant0/apkleaks/security/advisories/GHSA-8434-v7xw-8m9x

Get alerted when CVE-2021-21386 or the next vulnerability affects your stack