Description
react-native-keys 0.7.11 is vulnerable to sensitive information disclosure (remote) as encryption cipher and Base64 chunks are stored as plaintext in the compiled native binary. Attackers can extract these secrets using basic static analysis tools.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 0.7.11
References
Could your website be exposed too?
SmartScanner can check your website for react-native-keys insecurely stores encryption cipher and Base64 chunks and gives you actionable findings to investigate.
Start a free scanRelated Issues
- cipher-base is missing type checks, leading to hash rewind and passing on crafted data - CVE-2025-9287
- Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/react-start - CVE-2026-45321
- Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/react-start-rsc - CVE-2026-45321
- React Router has Path Traversal in File Session Storage - CVE-2025-61686
You might also like:
See something that needs correcting? Let us knowUpdated July 02, 2025