Packages / expo / Security

CriticalVulnerabilityGHSA-wr5g-q49g-548wCVE-2023-28131Published 24 Apr 2023

Expo SDK has an OAuth vulnerability

Affected releases · expo

  • 47.x and older0.1.1 – 47.0.14No fix, no longer updated

47.x has no fix yet; the newest fixed line:

npm install expo@48.0.0
58.x

  1. Not affected

    58.0.0 – 58.0.16

    17 releases, latest

47.x

  1. Affected

    47.0.0 – 47.0.14

    15 releases

46.x

  1. Affected

    46.0.0 – 46.0.21

    22 releases

45.x

  1. Affected

    45.0.0 – 45.0.8

    9 releases

44.x

  1. Affected

    44.0.0 – 44.0.6

    7 releases

43.x

  1. Affected

    43.0.0 – 43.0.5

    6 releases

42.x

  1. Affected

    42.0.0 – 42.0.5

    6 releases

41.x

  1. Affected

    41.0.0 – 41.0.1

    2 releases

40.x

  1. Affected

    40.0.0 – 40.0.1

    2 releases

39.x

  1. Affected

    39.0.0 – 39.0.5

    6 releases

38.x

  1. Affected

    38.0.0 – 38.0.11

    12 releases

37.x

  1. Affected

    37.0.0 – 37.0.12

    13 releases

36.x

  1. Affected

    36.0.0 – 36.0.2

    3 releases

35.x

  1. Affected

    35.0.0 – 35.0.1

    2 releases

34.x

  1. Affected

    34.0.0 – 34.0.4

    5 releases

33.x

  1. Affected

    33.0.0 – 33.0.7

    8 releases

32.x

  1. Affected

    32.0.0 – 32.0.6

    7 releases

31.x

  1. Affected

    31.0.0 – 31.0.6

    7 releases

30.x

  1. Affected

    30.0.0 – 30.0.2

    3 releases

29.x

  1. Affected

    29.0.0 – 29.0.1

    2 releases

28.x

  1. Affected

    28.0.0 – 28.0.1

    2 releases

27.x

  1. Affected

    27.0.0 – 27.1.1

    5 releases

26.x

  1. Affected

    26.0.0 – 26.1.1

    3 releases

25.x

  1. Affected

    25.0.0 – 25.1.2

    5 releases

24.x

  1. Affected

    24.0.0 – 24.1.1

    6 releases

23.x

  1. Affected

    23.0.0 – 23.1.1

    9 releases

22.x

  1. Affected

    22.0.0 – 22.1.0

    6 releases

21.x

  1. Affected

    21.0.0 – 21.0.3

    4 releases

20.x

  1. Affected

    20.0.0 – 20.1.4

    11 releases

19.x

  1. Affected

    19.0.0 – 19.0.1

    2 releases

18.x

  1. Affected

    18.0.0 – 18.0.9

    10 releases

17.x

  1. Affected

    17.0.0

    1 release

16.x

  1. Affected

    16.0.0

    1 release

15.x

  1. Affected

    15.0.0 – 15.1.3

    5 releases

14.x

  1. Affected

    14.0.0 – 14.0.2

    3 releases

1.x

  1. Affected

    1.0.0

    1 release

0.x

  1. Affected

    0.1.1 – 0.1.7

    7 releases

546 stable releases of expo, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for expo. It is read in your browser and sent nowhere.

What happens

A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that configured the "Expo AuthSession Redirect Proxy" for social sign-in. This can be achieved once a victim clicks a malicious link. The link itself may be sent to the victim in various ways (including email, text message, an attacker-controlled website, etc).