CVE-2025-45001

react-native-keys 0.7.11 is vulnerable to sensitive information disclosure (remote) as encryption cipher and Base64 chunks are stored as plaintext in the compiled native binary. Attackers can extract these secrets using basic static analysis tools.

CVSS v3.1 CNA

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.19% chance of exploitation in the next 30 days, 9th percentile

Published

2025-06-09

Proof-of-concept exploits (1)

• https://gist.github.com/ch3tanbug/44aedff79dd5d2d6beadbffcd01e0de5

Security advisories

• ch3tanbug/vulnerability-research/tree/main/CVE-2025-45001
• advisories/GHSA-fj44-h6xw-896g

References

• CVE Record
• NVD entry