AIKIDO-2025-10506
react-native-share is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
78
High Risk
This Affects:
react-native-shareTL;DR
Affected versions of this package may expose sensitive information due to the use of <root-path path="." /> in share_download_paths.xml. This configuration grants access to the app’s entire internal storage directory, potentially exposing files and subdirectories that were intended to remain private. As a result, other apps or users may gain unauthorized access to sensitive data such as configuration files, cached content, or authentication tokens. This constitutes a violation of access boundaries, exposing internal resources to a broader and unintended audience.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
react-native-share is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 3.2.0 - 12.1.0.
How to fix this
Upgrade the react-native-share library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant