Universal XSS in Android WebView

[gnardini]

Bug description:
Today we got a vulnerability report from npm: https://www.npmjs.com/advisories/1560

I'm only creating this issue to track progress on it, I apologize in advance if this is not the right place or way to do so.

To Reproduce:
Run yarn audit

Expected behavior:
No vulnerabilities found

Environment:

• OS: any
• OS version: any
• react-native version: 0.62.2
• react-native-webview version: 10.8.3

[cristianoccazinsp]

Remediation:
Ensure users update their Android WebView system component via the Google Play Store to 83.0.4103.106 or higher to avoid this UXSS. 'react-native-webview' is working on a mitigation but it could take some time.

Does this mean the library doesn't really have anything to do with the vulnerability? It is just a bug with Android that unfortunately affects react-native.

[dmythro]

I suppose here's a PR, but not merged yet so waiting for it: #1663

[win-perlego]

We have also received a warning from Github, see attached screenshot.

Can someone provide estimate for the fix #1663 to be merged in? Thank you so much.

[sagranatus]

please update this module... how can I use webview? is there any other option?

[ibelgin]

Is it really a vulnerability ? I am too getiing a warning from github

[amardeepranu]

Any updates here?

[luutruong]

Upgraded to 11.0.0 still have this issue.

[Raphaelinyang]

as at today, i still have this issue

[github-actions]

Hello 👋, this issue has been opened for more than 2 months with no activity on it. If the issue is still here, please keep in mind that we need community support and help to fix it! Just comment something like still searching for solutions and if you found one, please open a pull request! You have 7 days until this gets closed automatically

[awnoa]

Still searching for solutions

[alesandroortiz]

Per security advisory, 11.0.0 has a fix: GHSA-36j3-xxf7-4pqg

If your tooling is still indicating 11.0.0+ is vulnerable to this particular vulnerability, that is incorrect. Please comment which tool you are using and I will contact the appropriate vendor to correct their data.