shared_preferences_android vulnerability
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Code execution
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-502.
Summary
### Impact Due to some data types not being natively representable for the available storage options, shared_preferences_android serializes and deserializes special string prefixes to store these unrepresentable data types. This allows arbitrary classes to be deserialized leading to arbitrary code execution. As a result, Files containing the preferences can be overwritten with a malicious one with a deserialization payload that triggers as soon as the data is loaded from the disk. ### Patches 2.3.4 ### Workarounds Update to the latest version of shared_preferences_android that contains the changes to address this vulnerability. ### References TBD ### For more information See [our community page](https://dart.dev/community) to find ways to contact the team. ### Thanks Thank you so much to Oskar Zeino-Mahmalat from sonarsource for finding and reporting this issue!
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | shared_preferences_android (Pub) | 2.3.3 to before 2.3.4 | 2.3.4 | Patch available | GHSA-3hpf-ff72-j67p |
- shared_preferences_android (Pub) Vendor— Affected 2.3.3 to before 2.3.4 Fixed in 2.3.4 Patch available GHSA-3hpf-ff72-j67p
Remediation
- Fix · GHSA-3hpf-ff72-j67p shared_preferences_android (Pub) Fixed in 2.3.4 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-3hpf-ff72-j67p
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences