react-native-bottom-tabs: GitHub Actions कैनरी वर्कफ़्लो में मनमाना कोड निष्पादन से गुप्त जानकारी का रिसाव होता है

The impact of this vulnerability is severe. An attacker can craft a malicious pull request containing a harmful preinstall script within the package.json file. By triggering the vulnerable release-canary.yml workflow through a specific comment (!canary), the attacker can execute arbitrary code within the build environment. This code execution occurs with elevated privileges, enabling attackers to potentially exfiltrate sensitive data, compromise the build pipeline, or even gain control of the underlying infrastructure. The ability to execute arbitrary code opens the door to a wide range of malicious activities, making this a high-priority vulnerability to address.

React Native developers and organizations using the react-native-bottom-tabs library in their projects are at risk. This includes those relying on automated build pipelines and continuous integration/continuous delivery (CI/CD) systems, as the vulnerability can be exploited during the build process. Projects utilizing forked repositories or accepting pull requests from external contributors are particularly vulnerable.

• react: Examine your package.json files for suspicious preinstall scripts, especially in dependencies related to react-native-bottom-tabs.

grep 'preinstall' package.json

• github: Review your GitHub Actions workflows (.github/workflows/release-canary.yml) for improper use of pullrequesttarget event triggers. Ensure that only trusted code is executed in privileged contexts. • react: Check your project's dependencies for versions of react-native-bottom-tabs less than 0.9.3 using npm list react-native-bottom-tabs or yarn list react-native-bottom-tabs.

1. 2025-08-05Disclosure

   disclosure

1. आरक्षित2025-07-25
2. प्रकाशित2025-08-05
3. संशोधित2025-08-06
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2025-54594 is to upgrade to version 0.9.3 or later of the react-native-bottom-tabs library. If an immediate upgrade is not feasible due to compatibility issues or breaking changes, consider temporarily disabling the release-canary.yml workflow in your GitHub repository. Review and audit all pull requests, especially those from external contributors, to identify and reject any malicious scripts. Implement stricter code review processes and security scanning tools to detect potential vulnerabilities before they are merged into the codebase.