Expo on iOS is insecure due incorrect security attribute application
- Severity:
- Medium
Description
secure-store in Expo through 9.1.0 on iOS provides the insecure kSecAttrAccessibleAlwaysThisDeviceOnly policy when WHEN_UNLOCKED_THIS_DEVICE_ONLY is used.
Recommendation
Update the expo package to the latest compatible version. Followings are version details:
- Affected version(s): < 9.1.0
- Patched version(s): 9.1.0
References
Related Issues
- Vite has an `server.fs.deny` bypass with an invalid `request-target` - CVE-2025-32395
- Redwood is vulnerable to account takeover via dbAuth "forgot-password - Vulnerability
- Marp Core allows XSS by improper neutralization of HTML sanitization - CVE-2024-56510
- bootstrap Cross-site Scripting vulnerability (GHSA-ph58-4vrj-w6hr) 2 - CVE-2018-20677
- Tags:
- npm
- expo
Anything's wrong? Let us know Last updated on February 02, 2023