Expo on iOS is insecure due incorrect security attribute application

Description

secure-store in Expo through 9.1.0 on iOS provides the insecure kSecAttrAccessibleAlwaysThisDeviceOnly policy when WHEN_UNLOCKED_THIS_DEVICE_ONLY is used.

Recommendation

Update the expo package to the latest compatible version. Followings are version details:

• Affected version(s): < 9.1.0
• Patched version(s): 9.1.0

References

• GHSA-rwx9-wqj8-vr77
• CVE-2020-24653
• CAPEC-310
• OWASP 2021-A6

Related Issues

• crypto-js uses insecure random numbers - CVE-2020-36732
• GraphQL: Security breach on Viewer query - CVE-2020-15126
• survey-pdf Upgraded jsPDF Version Due to Security Vulnerability - CVE-2026-25630
• Insecure serialization leading to RCE in serialize-javascript - CVE-2020-7660

Tags:

npm

expo