CVE-2021-21386

APKLeaks is an open-source project for scanning APK file for URIs, endpoints & secrets. APKLeaks prior to v2.0.3 allows remote attackers to execute arbitrary OS commands via package name inside application manifest. An attacker could include arguments that allow unintended commands or code to be executed, allow sensitive data to be read or modified or could cause other unintended behavior through malicious package name. The problem is fixed in version v2.0.6-dev and above.

• CWE-78
• CWE-88

• https://github.com/dwisiswant0/apkleaks/commit/a966e781499ff6fd4eea66876d7532301b13a382Patch, Third Party Advisory
• https://github.com/dwisiswant0/apkleaks/security/advisories/GHSA-8434-v7xw-8m9xPatch, Third Party Advisory
• https://github.com/dwisiswant0/apkleaks/commit/a966e781499ff6fd4eea66876d7532301b13a382Patch, Third Party Advisory
• https://github.com/dwisiswant0/apkleaks/security/advisories/GHSA-8434-v7xw-8m9xPatch, Third Party Advisory

Published

Mar 24, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-21380XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2021-21381Flatpak is a system for building, distributing, and running …8.2
• CVE-2021-21382Restund is an open source NAT traversal server. The restund …9.6
• CVE-2021-21383Wiki.js an open-source wiki app built on Node.js. Wiki.js be…5.4
• CVE-2021-21384shescape is a simple shell escape package for JavaScript. In…7.8
• CVE-2021-21385Mifos-Mobile Android Application for MifosX is an Android Ap…7.4
• CVE-2021-21387Wrongthink peer-to-peer, end-to-end encrypted messenger with…7.5
• CVE-2021-21388systeminformation is an open source system and OS informatio…9.8
• CVE-2021-21389BuddyPress is an open source WordPress plugin to build a com…8.8
• CVE-2021-21390MinIO is an open-source high performance object storage serv…5.9
• CVE-2021-21391CKEditor 5 provides a WYSIWYG editing solution. This CVE aff…6.5
• CVE-2021-21392Synapse is a Matrix reference homeserver written in python (…6.3