{"id":"GHSA-3hpf-ff72-j67p","aliases":[],"url":"https://o3.security/vulnerability/GHSA-3hpf-ff72-j67p","summary":"shared_preferences_android vulnerability","details":"### Impact\nDue to some data types not being natively representable for the available storage options, shared_preferences_android serializes and deserializes special string prefixes to store these unrepresentable data types. This allows arbitrary classes to be deserialized leading to arbitrary code execution.\n\nAs a result, Files containing the preferences can be overwritten with a malicious one with a deserialization payload that triggers as soon as the data is loaded from the disk.\n\n### Patches\n2.3.4\n\n### Workarounds\nUpdate to the latest version of shared_preferences_android that contains the changes to address this vulnerability.\n\n### References\nTBD\n\n### For more information\nSee [our community page](https://dart.dev/community) to find ways to contact the team.\n\n### Thanks\nThank you so much to Oskar Zeino-Mahmalat from sonarsource for finding and reporting this issue!","published":"2024-12-06T21:24:30Z","modified":"2024-12-06T21:24:30Z","cvss":{"score":3,"severity":"LOW","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Pub","name":"shared_preferences_android","fixedVersion":"2.3.4"}],"fix":{"url":"https://github.com/flutter/packages/commit/15501ece235684a3bdddad089345fc3e33dc1df3","label":"flutter/packages@15501ec"},"references":[{"type":"WEB","url":"https://github.com/flutter/packages/security/advisories/GHSA-3hpf-ff72-j67p"},{"type":"WEB","url":"https://github.com/flutter/packages/commit/15501ece235684a3bdddad089345fc3e33dc1df3"},{"type":"PACKAGE","url":"https://github.com/flutter/packages"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2024-12-06T21:24:30Z"}}