CVE-2025-45001 react-native-keys insecurely stores encryption cipher and Base64 chunks
Attackers can extract sensitive encryption keys and secrets from the compiled binary via static analysis, exposing protected data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-45001?
CVE-2025-45001 is a high-severity vulnerability in n/a, published on 9 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
react-native-keys 0.7.11 is vulnerable to sensitive information disclosure (remote) as encryption cipher and Base64 chunks are stored as plaintext in the compiled native binary. Attackers can extract these secrets using basic static analysis tools.
Weakness: CWE-312
Which versions are affected by CVE-2025-45001?
2 open source packages ship an affected version, including react-native-keys. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
react-native-keys npm | All versions to 0.7.11 | None |
react-native-keys npm | All versions to 0.7.11 | None |
Products include Numan React-Native-Keys.
How do I fix CVE-2025-45001?
No fix has been published for CVE-2025-45001 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-45001 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-45001 exists.
Sources
Also known as GHSA-fj44-h6xw-896g.