Vulnerability · Published Mar 24, 2021 · Assigned by GitHub_M
CVE-2021-21386Improper Neutralization of Argument Delimiters in a Decompiling Package Process
Critical 9.3
In plain English
A critical-severity argument injection in apkleaks from dwisiswant0. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 84% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
APKLeaks is an open-source project for scanning APK file for URIs, endpoints & secrets. APKLeaks prior to v2.0.3 allows remote attackers to execute arbitrary OS commands via package name inside application manifest. An attacker could include arguments that allow unintended commands or code to be executed, allow sensitive data to be read or modified or could cause other unintended behavior through malicious package name. The problem is fixed in version v2.0.6-dev and above.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | apkleaks | 2.0.4 | GHSA-8434-v7xw-8m9x |
| PyPI | apkleaks | 2.0.4 | PYSEC-2026-281 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| dwisiswant0 | apkleaks | < 2.0.6-dev |
Weakness: CWE-88, CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N