GHSA-3hpf-ff72-j67p is a low-severity (CVSS 3) remote code execution vulnerability in shared_preferences_android. A fix is available for shared_preferences_android — see the affected versions and patch details below.
shared_preferences_android vulnerability
Real-World Exposure
shared_preferences_androidReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Pub packages — download data is not available via public APIs for these ecosystems.
Description
Impact
Due to some data types not being natively representable for the available storage options, shared_preferences_android serializes and deserializes special string prefixes to store these unrepresentable data types. This allows arbitrary classes to be deserialized leading to arbitrary code execution.
As a result, Files containing the preferences can be overwritten with a malicious one with a deserialization payload that triggers as soon as the data is loaded from the disk.
Patches
2.3.4
Workarounds
Update to the latest version of shared_preferences_android that contains the changes to address this vulnerability.
References
TBD
For more information
See our community page to find ways to contact the team.
Thanks
Thank you so much to Oskar Zeino-Mahmalat from sonarsource for finding and reporting this issue!
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🎯Pub | shared_preferences_android | ≥ 2.3.3&&< 2.3.4 | 2.3.4dart pub upgrade shared_preferences_android |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for shared_preferences_android, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update shared_preferences_android to 2.3.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-3hpf-ff72-j67p is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-3hpf-ff72-j67p can be triaged on real exposure rather than presence alone.
Tailored to GHSA-3hpf-ff72-j67p. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-3hpf-ff72-j67p in your dependencies?
O3 Security finds GHSA-3hpf-ff72-j67p across Pub dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.