Expo on iOS is insecure due incorrect security attribute application

CRITICAL 9.8CVE-2020-24653 · GHSA-rwx9-wqj8-vr77 · Published 26/08/2020 · updated 17/06/2026

In short

CVE-2020-24653 is a CRITICAL (CVSS 9.8) vulnerability affecting expo (expo), expo.
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 67.4% of all vulnerabilities.
Fix: update to 9.1.0 or later.

Package	Affected versions	Patched versions
expo expo	`≤ 2.16.1`	No fix yet
expo npm	`< 9.1.0`	`9.1.0`

Description

secure-store in Expo through 9.1.0 on iOS provides the insecure kSecAttrAccessibleAlwaysThisDeviceOnly policy when WHEN_UNLOCKED_THIS_DEVICE_ONLY is used.

NVD description

secure-store in Expo through 2.16.1 on iOS provides the insecure kSecAttrAccessibleAlwaysThisDeviceOnly policy when WHEN_UNLOCKED_THIS_DEVICE_ONLY is used.

References

nvd.nist.gov/vuln/detail/CVE-2020-24653 · ADVISORY
expo/expo#9264 · WEB
expo/expo commit 1d82bf0 · WEB
expo/expo · PACKAGE
expo/expo · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free