What is the CVSS score of CVE-2025-45001?

CVE-2025-45001 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of React are affected by CVE-2025-45001?

Applications using react-native-keys 0.7.11 expose encryption keys and sensitive credentials as plaintext in compiled binaries, allowing attackers to extract them through basic analysis tools without…

Is there a public PoC exploit available for CVE-2025-45001?

Yes, a public proof-of-concept exploit is available for CVE-2025-45001. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-45001?

Within 24 hours: inventory all applications and dependencies using react-native-keys 0.7.11 and assess which handle sensitive data (API keys, tokens, passwords). Within 7 days: migrate to an alternative secure key management solution or implement runtime encryption; conduct code review to identify what secrets were embedded. Within 30 days: rebuild and redistribute patched versions of affected applications, revoke all exposed credentials across systems, and audit logs for unauthorized access attempts.

React CVE-2025-45001

EUVD-2025-17558 HIGH

Cleartext Storage of Sensitive Information (CWE-312)

2025-06-09 cve@mitre.org

GHSA-fj44-h6xw-896g

Information Disclosure React React Native Keys

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17558

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

PoC Detected

Jun 23, 2025 - 14:18 vuln.today

Public exploit code

CVE Published

Jun 09, 2025 - 17:15 nvd

HIGH 7.5

DescriptionCVE.org

react-native-keys 0.7.11 is vulnerable to sensitive information disclosure (remote) as encryption cipher and Base64 chunks are stored as plaintext in the compiled native binary. Attackers can extract these secrets using basic static analysis tools.

AnalysisAI

react-native-keys version 0.7.11 contains a sensitive information disclosure vulnerability where encryption ciphers and Base64-encoded secrets are stored as plaintext in compiled native binaries, allowing attackers with network access to extract these credentials via static analysis of the binary. This affects all applications using the vulnerable library version, and the high CVSS score of 7.5 reflects the ease of exploitation (no authentication required) and significant confidentiality impact, though the practical risk depends on whether secrets are actually embedded at build time and the sensitivity of exposed data.

Technical ContextAI

react-native-keys is a React Native library for managing cryptographic keys and secrets. The vulnerability stems from CWE-312 (Cleartext Storage of Sensitive Information), where the library fails to implement proper secret management practices during the native binary compilation process. Instead of securely deriving keys at runtime or using platform-specific secure storage mechanisms (iOS Keychain, Android Keystore), the library embeds encryption cipher material and Base64-encoded key chunks directly into the compiled native binary artifacts (.so files on Android, frameworks on iOS). This makes secrets statically recoverable through simple binary analysis tools like strings, objdump, or radare2, defeating the entire purpose of using a key management library. The root cause is architectural: the library performs key initialization or storage at compile-time rather than leveraging runtime secure storage APIs.

RemediationAI

Immediate actions: (1) Audit your application's package.json and lock files to identify if react-native-keys version 0.7.11 is a direct or transitive dependency; (2) Check the official react-native-keys repository for a patched version (likely 0.7.12 or later, or a major version update); (3) Upgrade to the latest patched version with npm update react-native-keys or yarn upgrade react-native-keys, then rebuild native binaries; (4) For applications already in production with 0.7.11, prioritize releasing an updated version to app stores with the patched library. Workarounds (if no patch available immediately): (a) Migrate to alternative key management solutions that properly use platform-specific secure storage (iOS Keychain via react-native-keychain, Android Keystore via react-native-keystore or similar); (b) Refactor the application to load sensitive secrets from a secure remote backend at runtime rather than embedding them at build time; (c) Use obfuscation tools as a short-term mitigation, though this does not eliminate the vulnerability. Long-term: adopt secure coding practices such as never storing plaintext secrets in binaries, leveraging native platform security APIs, and conducting regular security audits of dependency chains.