Security vulnerabilities and automated fixes for react native issues
2 posts found
CVE-2026-9277 is a critical command injection vulnerability in shell-quote versions before 1.9.0, where unescaped line terminators allow attackers to break out of quoted strings and execute arbitrary shell commands. The fix upgrades the dependency across multiple React Native CLI packages and related libraries through npm overrides.
CVE-2026-13149 is a high-severity Denial of Service vulnerability in the `brace-expansion` npm package, where specially crafted brace patterns trigger exponential-time processing that can freeze or crash a Node.js application. The fix upgrades the package from version 1.1.14 to 2.1.2 in the React Native frontend's `package-lock.json`, eliminating the vulnerable code path. Because the affected file is in production code, unpatched applications could be targeted by any attacker able to influence b