NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🎯
🎯 Pub
Not in CISA KEV
LOW severity

shared_preferences_android vulnerabilityGHSA-3hpf-ff72-j67p

LOWFix: flutter/packages@15501ec

GHSA-3hpf-ff72-j67p is a low-severity (CVSS 3) remote code execution vulnerability in shared_preferences_android. A fix is available for shared_preferences_android — see the affected versions and patch details below.

Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Dec 6, 2024 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
🎯shared_preferences_android

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Pub packages — download data is not available via public APIs for these ecosystems.

Description

Impact

Due to some data types not being natively representable for the available storage options, shared_preferences_android serializes and deserializes special string prefixes to store these unrepresentable data types. This allows arbitrary classes to be deserialized leading to arbitrary code execution.

As a result, Files containing the preferences can be overwritten with a malicious one with a deserialization payload that triggers as soon as the data is loaded from the disk.

Patches

2.3.4

Workarounds

Update to the latest version of shared_preferences_android that contains the changes to address this vulnerability.

References

TBD

For more information

See our community page to find ways to contact the team.

Thanks

Thank you so much to Oskar Zeino-Mahmalat from sonarsource for finding and reporting this issue!

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🎯Pubshared_preferences_android≥ 2.3.3&&< 2.3.42.3.4dart pub upgrade shared_preferences_android

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for shared_preferences_android, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update shared_preferences_android to 2.3.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-3hpf-ff72-j67p is resolved across your whole dependency graph.

  3. Workarounds

    Do not deserialise data from untrusted sources: where the format allows it, restrict deserialisation to an explicit allowlist of expected types, and prefer a data-only format (JSON, Protobuf) over one that can reconstruct arbitrary objects until you can upgrade.

Frequently Asked Questions

### Impact Due to some data types not being natively representable for the available storage options, shared_preferences_android serializes and deserializes special string prefixes to store these unrepresentable data types. This allows arbitrary classes to be deserialized leading to arbitrary code execution. As a result, Files containing the preferences can be overwritten with a malicious one with a deserialization payload that triggers as soon as the data is loaded from the disk. ### Patches 2.3.4 ### Workarounds Update to the latest version of shared_preferences_android that contains the
O3 Security · Impact-Aware SCA

Is GHSA-3hpf-ff72-j67p in your dependencies?

Find it across Pub, including transitive dependencies.

Scan my dependencies How O3 SCA works
GHSA-3hpf-ff72-j67p: shared_preferences — Fixed in 2.3.4