CVE-2021-21386 Improper Neutralization of Argument Delimiters in a Decompiling Package Process
Remote attackers can execute arbitrary OS commands via malicious package names in APK manifests, affecting APKLeaks users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-21386?
CVE-2021-21386 is a critical command injection vulnerability in dwisiswant0 apkleaks, published on 24 Mar 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
APKLeaks is an open-source project for scanning APK file for URIs, endpoints & secrets. APKLeaks prior to v2.0.3 allows remote attackers to execute arbitrary OS commands via package name inside application manifest. An attacker could include arguments that allow unintended commands or code to be executed, allow sensitive data to be read or modified or could cause other unintended behavior through malicious package name. The problem is fixed in version v2.0.6-dev and above.
Which versions are affected by CVE-2021-21386?
3 open source packages ship an affected version, including apkleaks and APKLeaks. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
apkleaks PyPI | All versions | 2.0.4 |
apkleaks PyPI | All versions | 2.0.4 |
APKLeaks PyPI | All versions | 2.0.4 |
Products include Apkleaks Project Apkleaks.
How do I fix CVE-2021-21386?
Upgrade apkleaks to 2.0.4 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-21386 being exploited?
There is no known exploitation of CVE-2021-21386 in the wild and no public exploit code.
Sources
Also known as GHSA-8434-v7xw-8m9x, PYSEC-2026-281.