TI-2020-15121 Aliases CVE-2020-24653 GHSA-rwx9-wqj8-vr77

secure-store in Expo through 2.16.1 on iOS provides the insecure…

MEDIUM 44Published 2020-08-26 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

secure-store in Expo through 2.16.1 on iOS provides the insecure kSecAttrAccessibleAlwaysThisDeviceOnly policy when WHEN_UNLOCKED_THIS_DEVICE_ONLY is used.

Why it matters now

EPSS 0.0117 67th percentileScored 2026-11-07

Fix Fixed expo (npm): 9.1.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	expo (npm)	before 9.1.0	9.1.0	Patch available	GHSA-rwx9-wqj8-vr77

— Vendor— Affected all versions Fixed in — No fix listed CNA
expo (npm) Vendor— Affected before 9.1.0 Fixed in 9.1.0 Patch available GHSA-rwx9-wqj8-vr77

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:expo:expo::::::iphone_os::*	up to 2.16.1	Vulnerable	Expo

cpe:2.3:a:expo:expo:*:*:*:*:*:iphone_os:*:* Versions up to 2.16.1 Vulnerable ·Expo

Remediation

Fix · GHSA-rwx9-wqj8-vr77 expo (npm) Fixed in 9.1.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2020-24653
2026-10-03 Alias added: GHSA-rwx9-wqj8-vr77

References

Patch 1

https://github.com/expo/expo/pull/9264

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2020-24653

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences