GitHub Advisoryadvisory · npm

GHSA-fj44-h6xw-896g react-native-keys insecurely stores encryption cipher and Base64 chunks

HIGH Published 2025-06-09 Modified 2025-07-02 Official page ↗
Aliases
CVE-2025-45001
Ecosystem
npm
Packages
react-native-keys
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-312
Reviewed
2025-07-02

Affected packages

• npm react-native-keys: <= 0.7.11 (no fix yet)

Description

react-native-keys 0.7.11 is vulnerable to sensitive information disclosure (remote) as encryption cipher and Base64 chunks are stored as plaintext in the compiled native binary. Attackers can extract these secrets using basic static analysis tools.

Related

Alias · CVE (1)

  • CVE-2025-45001 react-native-keys 0.7.11 is vulnerable to sensitive information disclosure (remote) as encryption cipher and Base64 chunks are stored as… vulnerability

Weakness · CWE (1)

  • CWE-312 Cleartext Storage of Sensitive Information weakness

References