Expo on iOS is insecure due incorrect security attribute application

严重 9.8CVE-2020-24653 · GHSA-rwx9-wqj8-vr77 · Published 26/08/2020 · updated 17/06/2026

要点

CVE-2020-24653 是影响 expo (expo), expo 的严重 (CVSS 9.8)漏洞。
未来 30 天内被利用的概率（EPSS）：1.2%，高于 67.4% 的漏洞。
修复：升级到 9.1.0 或更高版本。

Package	Affected versions	Patched versions
expo expo	`≤ 2.16.1`	No fix yet
expo npm	`< 9.1.0`	`9.1.0`

Description

secure-store in Expo through 9.1.0 on iOS provides the insecure kSecAttrAccessibleAlwaysThisDeviceOnly policy when WHEN_UNLOCKED_THIS_DEVICE_ONLY is used.

NVD description

secure-store in Expo through 2.16.1 on iOS provides the insecure kSecAttrAccessibleAlwaysThisDeviceOnly policy when WHEN_UNLOCKED_THIS_DEVICE_ONLY is used.

References

nvd.nist.gov/vuln/detail/CVE-2020-24653 · ADVISORY
expo/expo#9264 · WEB
expo/expo commit 1d82bf0 · WEB
expo/expo · PACKAGE
expo/expo · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free