numandev1/react-native-keys · Security
react-native-keys insecurely stores encryption cipher and Base64 chunks
- GHSA ID
- GHSA-fj44-h6xw-896g
- CVE ID
- CVE-2025-45001
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
react-native-keys 0.7.11 is vulnerable to sensitive information disclosure (remote) as encryption cipher and Base64 chunks are stored as plaintext in the compiled native binary. Attackers can extract these secrets using basic static analysis tools.
CWEs
- CWE-312 · Cleartext Storage of Sensitive Information