-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stems from the Android native code bridge logging the encryption key during MMKV instance creation. The commit a8995cc specifically modifies the logging statement in MmkvHostObject.cpp's constructor to stop printing cryptKey.c_str() and instead log a boolean indicating encryption status. This directly matches the CWE-532 description of sensitive information in logs, and the function's role in initializing the database with cryptographic material makes it the clear vulnerability source.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| react-native-mmkv | npm | < 2.11.0 | 2.11.0 |
Ongoing coverage of React2Shell