Packages / react-native-webview / Security

ModerateVulnerabilityGHSA-36j3-xxf7-4pqgCVE-2020-6506Published 2 Oct 2020

Android WebView Universal Cross-site Scripting

Affected releases · react-native-webview

  • 10.x and older1.0.0 – 10.10.2No fix, no longer updated

10.x has no fix yet; the newest fixed line:

npm install react-native-webview@11.0.0
16.x

  1. Not affected

    16.0.0

    1 release

10.x

  1. Affected

    10.0.0 – 10.10.2

    28 releases

9.x

  1. Affected

    9.0.0 – 9.4.0

    13 releases

8.x

  1. Affected

    8.0.0 – 8.2.1

    12 releases

7.x

  1. Affected

    7.0.0 – 7.6.0

    29 releases

6.x

  1. Affected

    6.0.0 – 6.11.1

    25 releases

5.x

  1. Affected

    5.0.0 – 5.12.1

    43 releases

4.x

  1. Affected

    4.0.0 – 4.2.0

    3 releases

3.x

  1. Affected

    3.0.0 – 3.2.2

    11 releases

2.x

  1. Affected

    2.0.0 – 2.15.0

    25 releases

1.x

  1. Affected

    1.0.0 – 1.3.0

    11 releases

344 stable releases of react-native-webview, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for react-native-webview. It is read in your browser and sent nowhere.

What happens

A universal cross-site scripting (UXSS) vulnerability, CVE-2020-6506 (crbug.com/1083819), has been identified in the Android WebView system component, which allows cross-origin iframes to execute arbitrary JavaScript in the top-level document. This vulnerability affects React Native apps which use a react-native-webview that allows navigation to arbitrary URLs, and when that app runs on systems with an Android WebView version prior to 83.0.4103.106.

Pending mitigation

Ensure users update their Android WebView system component via the Google Play Store to 83.0.4103.106 or higher to avoid this UXSS. 'react-native-webview' is working on a mitigation but it could take some time.

References

alesandroortiz.com/articles/uxss-android-webvie…