Executive brief
React Native Document Picker is a mobile library that enables apps to let users select files from their device. A directory traversal vulnerability in the Android component allows a local attacker to craft a malicious script that can escape intended directory boundaries and execute arbitrary code, potentially compromising the entire app and any data it can access.
Technical details
The vulnerability is a directory traversal (path traversal) flaw in the Android library component of React Native Document Picker, classified as CWE-26. The vulnerability exists in the RNDocumentPickerModule.java file and allows an attacker to bypass path validation through a crafted script. Attack requires local access and user interaction (opening a document picker dialog). An unauthenticated local attacker can execute arbitrary code on the affected device. The issue was patched in versions 8.2.2 and 9.1.1, with fixes committed to the repository on 2024-02-05.
Affected products
- React Native Community Document Picker before 8.2.2 and 9.0.0 before 9.1.1
Timeline
- 2024-02-16: disclosed: Published in GHSA and NVD
- 2024-02-05: patched: Patches merged in versions 8.2.2 and 9.1.1