AIKIDO-2026-10992
@sentry/react-native is vulnerable to Relative Path Traversal
59
Medium Risk
This Affects:
@sentry/react-nativeTL;DR
The @sentry/react-native native getDataFromUri bridge could read file and content URIs outside the app's allowed storage roots when given attacker-influenced paths. Metro dev middleware and web release constant injection also lacked path containment or proper escaping, enabling directory escape during development and script injection in generated bundles. Gradle upload logging could expose Sentry auth tokens when flavor-aware CLI arguments were enabled. The patch restricts URI targets, canonicalizes Metro paths, JSON-escapes injected release fields, and masks tokens in lifecycle logs.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@sentry/react-native is vulnerable to Relative Path Traversal in versions 1.0.0 - 8.9.2.
How to fix this
Upgrade the @sentry/react-native library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant