CODEWITHSUNDEEP
react-nativereact-native-webview
l4rnaud
l4rnaud

Reputation: 319

react-native-webview high vulnerability UXSS

I started a new ReactNative app and tried to use webview for playing Youtube Video It was ok the last time i used it but this time when i install the package i get a high vulnerability message : " High Universal XSS in Android WebView" More info : https://npmjs.com/advisories/1560

My questions :

Upvotes: 3

Views: 1202

Answers (1)

Ton Snoei
Ton Snoei

Reputation: 3195

It is good that you are security aware!

Can we use it?

I don't think Google will reject your app. In other words, we launched a few apps using react-native-webview and did not experience any problem when launching on Google Play.

This vulnerability affects React Native apps which use a react-native-webview that allows navigation to arbitrary URLs. I don't think you use the webview that way.

So, yes, I think you can use it.

How to fix it?

As found in the advisory https://npmjs.com/advisories/1560:

Ensure users update their Android WebView system component via the Google Play Store to 83.0.4103.106 or higher to avoid this UXSS. 'react-native-webview' is working on a mitigation but it could take some time.

So you have to be patient and wait for a fix. The way you use it is save.

Upvotes: 1

Related Questions