Expo on iOS is insecure due incorrect security attribute application

Description

secure-store in Expo through 9.1.0 on iOS provides the insecure kSecAttrAccessibleAlwaysThisDeviceOnly policy when WHEN_UNLOCKED_THIS_DEVICE_ONLY is used.

Recommendation

Update the expo package to the latest compatible version. Followings are version details:

• Affected version(s): < 9.1.0
• Patched version(s): 9.1.0

References

• GHSA-rwx9-wqj8-vr77
• CVE-2020-24653
• CAPEC-310
• OWASP 2021-A6

Related Issues

• MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827 - CVE-2025-67898
• XSS due to lack of CSRF validation for replying/publishing - CVE-2020-15156
• GraphQL: Security breach on Viewer query - CVE-2020-15126
• Insecure serialization leading to RCE in serialize-javascript - CVE-2020-7660

Tags:

npm

expo