Expo on iOS is insecure due incorrect security attribute application

Description

secure-store in Expo through 9.1.0 on iOS provides the insecure kSecAttrAccessibleAlwaysThisDeviceOnly policy when WHEN_UNLOCKED_THIS_DEVICE_ONLY is used.

Recommendation

Update the expo package to the latest compatible version. Followings are version details:

• Affected version(s): < 9.1.0
• Patched version(s): 9.1.0

References

• GHSA-rwx9-wqj8-vr77
• CVE-2020-24653
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Incorrect Calculation in the MSR JavaScript Cryptography Library - CVE-2020-1026
• MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827 - CVE-2025-67898
• survey-pdf Upgraded jsPDF Version Due to Security Vulnerability - CVE-2026-25630
• ion-parser Prototype Pollution when malicious INI file submitted to application that parses with `parse` - CVE-2020-28462

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

expo