{"id":"GHSA-3hpf-ff72-j67p","aliases":[],"status":"published","title":"shared_preferences_android vulnerability","description":"### Impact\nDue to some data types not being natively representable for the available storage options, shared_preferences_android serializes and deserializes special string prefixes to store these unrepresentable data types. This allows arbitrary classes to be deserialized leading to arbitrary code execution.\n\nAs a result, Files containing the preferences can be overwritten with a malicious one with a deserialization payload that triggers as soon as the data is loaded from the disk.\n\n### Patches\n2.3.4\n\n### Workarounds\nUpdate to the latest version of shared_preferences_android that contains the changes to address this vulnerability.\n\n### References\nTBD\n\n### For more information\nSee [our community page](https://dart.dev/community) to find ways to contact the team.\n\n### Thanks\nThank you so much to Oskar Zeino-Mahmalat from sonarsource for finding and reporting this issue!","severity":{"version":"3.1","score":3,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L","level":"low","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2024-12-06T21:24:30Z","modified":"2024-12-09T10:40:08Z","fixes":[{"ecosystem":"Pub","package":"shared_preferences_android","fixed_in":["2.3.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Pub","package":"shared_preferences_android","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.3"},{"last_affected":"2.3.3"},{"fixed":"2.3.4"}]}],"versions":["2.3.3"]},{"source":"osv","ecosystem":"Pub","package":"shared_preferences_android","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.3"},{"fixed":"2.3.4"}]}],"versions":["2.3.3"]}],"references":[{"url":"https://github.com/flutter/packages/security/advisories/GHSA-3hpf-ff72-j67p","tags":["web"]},{"url":"https://github.com/flutter/packages/commit/15501ece235684a3bdddad089345fc3e33dc1df3","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3hpf-ff72-j67p"},{"url":"https://github.com/flutter/packages","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-3hpf-ff72-j67p","title":"shared_preferences_android vulnerability","description":"### Impact\nDue to some data types not being natively representable for the available storage options, shared_preferences_android serializes and deserializes special string prefixes to store these unrepresentable data types. This allows arbitrary classes to be deserialized leading to arbitrary code execution.\n\nAs a result, Files containing the preferences can be overwritten with a malicious one with a deserialization payload that triggers as soon as the data is loaded from the disk.\n\n### Patches\n2.3.4\n\n### Workarounds\nUpdate to the latest version of shared_preferences_android that contains the changes to address this vulnerability.\n\n### References\nTBD\n\n### For more information\nSee [our community page](https://dart.dev/community) to find ways to contact the team.\n\n### Thanks\nThank you so much to Oskar Zeino-Mahmalat from sonarsource for finding and reporting this issue!","status":"published","published":"2024-12-06T21:24:30Z","modified":"2024-12-09T10:40:08Z","cvss":[{"version":"3.1","score":3,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L","level":"low"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:38:24.542211Z"}],"osv":[{"id":"GHSA-3hpf-ff72-j67p","title":"shared_preferences_android vulnerability","description":"### Impact\nDue to some data types not being natively representable for the available storage options, shared_preferences_android serializes and deserializes special string prefixes to store these unrepresentable data types. This allows arbitrary classes to be deserialized leading to arbitrary code execution.\n\nAs a result, Files containing the preferences can be overwritten with a malicious one with a deserialization payload that triggers as soon as the data is loaded from the disk.\n\n### Patches\n2.3.4\n\n### Workarounds\nUpdate to the latest version of shared_preferences_android that contains the changes to address this vulnerability.\n\n### References\nTBD\n\n### For more information\nSee [our community page](https://dart.dev/community) to find ways to contact the team.\n\n### Thanks\nThank you so much to Oskar Zeino-Mahmalat from sonarsource for finding and reporting this issue!","status":"published","published":"2024-12-06T21:24:30Z","modified":"2024-12-06T21:24:30Z","cvss":[{"version":"3.1","score":3,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L","level":"low"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:35.747385Z"}]}}