~ / search / GHSA-6xhg-q9c8-rj32

GHSA-6xhg-q9c8-rj32

Credential leak in react-native-fast-image

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-7696

Packages

EcosystemPackageAffectedFixed in
npm react-native-fast-image < 8.3.0 8.3.0

Details

As written in the advisory (Markdown source, shown as plain text).

This affects all versions before version 8.3.0 of package react-native-fast-image. When an image with `source={{uri: "...", headers: { host: "somehost.com", authorization: "..." }}` is loaded, all other subsequent images will use the same headers, this can lead to signing credentials or other session tokens being leaked to other servers.

References

External links from the advisory. They lead to third-party sites.