What is the CVSS score of CVE-2024-21668?

CVE-2024-21668 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of React Native Mmkv are affected by CVE-2024-21668?

Organizations using react-native-mmkv should be aware of moderate risk from CVE-2024-21668, a log file exposure vulnerability rated CVSS 4.4. This could allow unauthorized file access.. A patch is available.

How to fix or mitigate CVE-2024-21668?

During next maintenance window: Identify affected systems and apply vendor patches when convenient. Review data exposure and access controls.

React Native Mmkv CVE-2024-21668

MEDIUM

Insertion of Sensitive Information into Log File (CWE-532)

2024-01-09 security-advisories@github.com

Information Disclosure Apple Google React Native Mmkv Android iOS

4.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.4 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 19:34 vuln.today

Patch released

Mar 28, 2026 - 19:34 nvd

Patch available

CVE Published

Jan 09, 2024 - 19:15 nvd

MEDIUM 4.4

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 npm packages depend on react-native-mmkv (5 direct, 1 indirect)

Ecosystem-wide dependent count for version 2.11.0.

DescriptionGitHub Advisory

react-native-mmkv is a library that allows easy use of MMKV inside React Native applications. Before version 2.11.0, the react-native-mmkv logged the optional encryption key for the MMKV database into the Android system log. The key can be obtained by anyone with access to the Android Debugging Bridge (ADB) if it is enabled in the phone settings. This bug is not present on iOS devices. By logging the encryption secret to the system logs, attackers can trivially recover the secret by enabling ADB and undermining an app's thread model. This issue has been patched in version 2.11.0.

AnalysisAI

react-native-mmkv is a library that allows easy use of MMKV inside React Native applications. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-532. react-native-mmkv is a library that allows easy use of MMKV inside React Native applications. Before version 2.11.0, the react-native-mmkv logged the optional encryption key for the MMKV database into the Android system log. The key can be obtained by anyone with access to the Android Debugging Bridge (ADB) if it is enabled in the phone settings. This bug is not present on iOS devices. By logging the encryption secret to the system logs, attackers can trivially recover the secret by enabling ADB and undermining an app's thread model. This issue has been patched in version 2.11.0. Affected products include: Mrousavy React-Native-Mmkv. Version information: version 2.11.0.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.