Packages / expo / Security

ModerateVulnerabilityGHSA-rwx9-wqj8-vr77CVE-2020-24653Published 24 May 2022

Expo on iOS is insecure due incorrect security attribute application

Affected releases · expo

  • 1.x and older0.1.1 – 1.0.0No fix, no longer updated

1.x has no fix yet; the newest fixed line:

npm install expo@9.1.0
58.x

  1. Not affected

    58.0.0 – 58.0.16

    17 releases, latest

1.x

  1. Affected

    1.0.0

    1 release

0.x

  1. Affected

    0.1.1 – 0.1.7

    7 releases

546 stable releases of expo, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for expo. It is read in your browser and sent nowhere.

What happens

secure-store in Expo through 9.1.0 on iOS provides the insecure kSecAttrAccessibleAlwaysThisDeviceOnly policy when WHEN_UNLOCKED_THIS_DEVICE_ONLY is used.