Description
A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that configured the “Expo AuthSession Redirect Proxy” for social sign-in. This can be achieved once a victim clicks a malicious link.
Recommendation
Update the expo package to the latest compatible version. Followings are version details:
- Affected version(s): < 48.0.0
- Patched version(s): 48.0.0
References
- GHSA-wr5g-q49g-548w
- blog.expo.dev
- www.darkreading.com
- CVE-2023-28131
- CWE-522
- CAPEC-310
- OWASP 2021-A4
- OWASP 2021-A6
Related Issues
- DocsGPT Allows Remote Code Execution - CVE-2025-0868
- @rpldy/uploader prototype pollution - CVE-2024-57082
- Signature Malleabillity in elliptic - CVE-2020-13822
- Joplin Vulnerable to Code Injection - CVE-2022-23340
- Tags:
- npm
- expo
Anything's wrong? Let us know Last updated on October 15, 2025