Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

react-native-mmkv

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.4npmAmendedPublished

    react-native-mmkv Insertion of Sensitive Information into Log File vulnerability

    CVE-2024-21668 · GHSA-4jh3-6jhv-2mgp

    Affected
    • npm react-native-mmkv < 2.11.0
    Fixed in
    2.11.0· Vendor fix available
    Issue
    Before version v2.11.0, the react-native-mmkv logged the optional encryption key for the MMKV database into the Android system log. The key can be obtained by anyone with access to the Android Debugging Bridge (ADB) if it is enabled in the phone settings. This bug is not present on iOS devices. Details The bridge for communicating between JS code and native code on Android logs the encryption key. This was fixed in commit a8995cc by only logging whether encryption is used. Impact The encryption of an MMKV database protects data from higher privilege processes on the phone that can access the app storage. Additionally, if data in the app's storage is encrypted, it is also encrypted in potential backups. By logging the encryption secret to the system logs, attackers can trivially recover the secret by enabling ADB and undermining an app's thread model. The bug was discovered and fixed by somebody else. Not me. I'm just reporting this so users of react-native-mmkv upgrade the…

    Recommended action: Upgrade to 2.11.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →