@W-20151632: MSDK Android Security Bug: CVE-2025-11953 - React Native Community CLI (RCE) #2800

JohnsonEricAtSalesforce · 2025-11-06T23:48:02Z

🎸 Ready For Review 🥁

This updates the SalesforceReact library for Android to React Native 0.82.1 according to the official React Native Upgrade Helper. Note: This won't be merged until it's tested with corresponding changes to the template apps.

… Community CLI (RCE)

JohnsonEricAtSalesforce · 2025-11-06T23:50:08Z

libs/SalesforceReact/package.json

-    "react-native": "0.79.3",
+    "react": "19.1.1",
+    "react-native": "0.82.1",
+    "@react-native/new-app-screen": "0.82.1",


@wmathurin - Since this is a library module, think we should try to avoid adding the two new dependencies here? The upgrade helper is only available for apps - not libraries. All the other files in the upgrade helper with obvious app-level changes are already absent from our library with this one exception.

I think we only need them in apps.
Also shouldn't you upgrade react-native-force (i.e. SalesforceMobileSDK-ReactNative) first?

brandonpage · 2025-11-06T23:57:14Z

libs/SalesforceReact/package.json

-    "node": ">=18"
+    "node": ">=20"


We need to update the versions spreadsheet so this new min version gets added to release notes.

… Community CLI (RCE) (Gradle and Android Gradle Plug In Updates)

github-actions · 2025-11-10T21:44:20Z

libs/SalesforceSDK/build.gradle.kts

    implementation("androidx.appcompat:appcompat:1.7.1")
    implementation("androidx.biometric:biometric:1.2.0-alpha05")
    implementation("androidx.lifecycle:lifecycle-extensions:2.2.0")
    implementation("androidx.core:core-ktx:1.16.0") // Update requires API 36 compileSdk


⚠️ A newer version of androidx.core:core-ktx than 1.16.0 is available: 1.17.0

github-actions · 2025-11-10T21:44:21Z

libs/SalesforceSDK/build.gradle.kts

    implementation("androidx.biometric:biometric:1.2.0-alpha05")
    implementation("androidx.lifecycle:lifecycle-extensions:2.2.0")
    implementation("androidx.core:core-ktx:1.16.0") // Update requires API 36 compileSdk
    implementation("androidx.activity:activity-ktx:$androidXActivityVersion")


⚠️ A newer version of androidx.activity:activity-ktx than 1.10.1 is available: 1.11.0

github-actions · 2025-11-10T21:44:22Z

libs/SalesforceSDK/build.gradle.kts

    implementation("androidx.lifecycle:lifecycle-extensions:2.2.0")
    implementation("androidx.core:core-ktx:1.16.0") // Update requires API 36 compileSdk
    implementation("androidx.activity:activity-ktx:$androidXActivityVersion")
    implementation("androidx.activity:activity-compose:$androidXActivityVersion")


⚠️ A newer version of androidx.activity:activity-compose than 1.10.1 is available: 1.11.0

github-actions · 2025-11-10T21:44:22Z

libs/SalesforceSDK/build.gradle.kts

-    implementation("androidx.lifecycle:lifecycle-viewmodel-compose:$livecycleVersion")
-    implementation("androidx.lifecycle:lifecycle-viewmodel-savedstate:$livecycleVersion")
-    implementation("androidx.lifecycle:lifecycle-service:$livecycleVersion")
+    implementation("androidx.lifecycle:lifecycle-viewmodel-ktx:$lifecycleVersion")


⚠️ A newer version of androidx.lifecycle:lifecycle-viewmodel-ktx than 2.8.7 is available: 2.9.4

github-actions · 2025-11-10T21:44:23Z

libs/SalesforceSDK/build.gradle.kts

-    implementation("androidx.lifecycle:lifecycle-viewmodel-savedstate:$livecycleVersion")
-    implementation("androidx.lifecycle:lifecycle-service:$livecycleVersion")
+    implementation("androidx.lifecycle:lifecycle-viewmodel-ktx:$lifecycleVersion")
+    implementation("androidx.lifecycle:lifecycle-viewmodel-compose:$lifecycleVersion")


⚠️ A newer version of androidx.lifecycle:lifecycle-viewmodel-compose than 2.8.7 is available: 2.9.4

github-actions · 2025-11-10T21:44:24Z

libs/SalesforceSDK/build.gradle.kts

-    implementation("androidx.lifecycle:lifecycle-service:$livecycleVersion")
+    implementation("androidx.lifecycle:lifecycle-viewmodel-ktx:$lifecycleVersion")
+    implementation("androidx.lifecycle:lifecycle-viewmodel-compose:$lifecycleVersion")
+    implementation("androidx.lifecycle:lifecycle-viewmodel-savedstate:$lifecycleVersion")


⚠️ A newer version of androidx.lifecycle:lifecycle-viewmodel-savedstate than 2.8.7 is available: 2.9.4

github-actions · 2025-11-10T21:44:25Z

libs/SalesforceSDK/build.gradle.kts

+    implementation("androidx.lifecycle:lifecycle-viewmodel-ktx:$lifecycleVersion")
+    implementation("androidx.lifecycle:lifecycle-viewmodel-compose:$lifecycleVersion")
+    implementation("androidx.lifecycle:lifecycle-viewmodel-savedstate:$lifecycleVersion")
+    implementation("androidx.lifecycle:lifecycle-service:$lifecycleVersion")


⚠️ A newer version of androidx.lifecycle:lifecycle-service than 2.8.7 is available: 2.9.4

github-actions · 2025-11-10T21:44:25Z

libs/SalesforceSDK/build.gradle.kts

+    implementation("androidx.lifecycle:lifecycle-viewmodel-compose:$lifecycleVersion")
+    implementation("androidx.lifecycle:lifecycle-viewmodel-savedstate:$lifecycleVersion")
+    implementation("androidx.lifecycle:lifecycle-service:$lifecycleVersion")
    implementation("org.jetbrains.kotlinx:kotlinx-serialization-json:1.6.3") // Update requires Kotlin 2.


⚠️ A newer version of org.jetbrains.kotlinx:kotlinx-serialization-json than 1.6.3 is available: 1.9.0

github-actions · 2025-11-10T21:44:26Z

libs/SalesforceSDK/build.gradle.kts

+    implementation("androidx.lifecycle:lifecycle-viewmodel-savedstate:$lifecycleVersion")
+    implementation("androidx.lifecycle:lifecycle-service:$lifecycleVersion")
    implementation("org.jetbrains.kotlinx:kotlinx-serialization-json:1.6.3") // Update requires Kotlin 2.
    implementation("androidx.window:window:1.4.0")


⚠️ A newer version of androidx.window:window than 1.4.0 is available: 1.5.0

github-actions · 2025-11-10T21:44:27Z

	15 Warnings
⚠️	libs/SalesforceSDK/build.gradle.kts#L19 - A newer version of com.squareup.okhttp3:okhttp than 4.12.0 is available: 5.3.0
⚠️	libs/SalesforceSDK/build.gradle.kts#L20 - A newer version of com.google.firebase:firebase-messaging than 25.0.0 is available: 25.0.1
⚠️	libs/SalesforceSDK/build.gradle.kts#L21 - A newer version of androidx.core:core than 1.16.0 is available: 1.17.0
⚠️	libs/SalesforceSDK/build.gradle.kts#L22 - A newer version of androidx.browser:browser than 1.8.0 is available: 1.9.0
⚠️	libs/SalesforceSDK/build.gradle.kts#L23 - A newer version of androidx.work:work-runtime-ktx than 2.10.3 is available: 2.11.0
⚠️	libs/SalesforceSDK/build.gradle.kts#L39 - A newer version of androidx.compose.material3:material3-android than 1.3.2 is available: 1.4.0
⚠️	libs/SalesforceSDK/build.gradle.kts#L40 - A newer version of androidx.compose:compose-bom than 2025.07.00 is available: 2025.11.00
⚠️	libs/SalesforceSDK/build.gradle.kts#L41 - A newer version of androidx.compose.foundation:foundation-android than 1.8.2 is available: 1.9.4
⚠️	libs/SalesforceSDK/build.gradle.kts#L42 - A newer version of androidx.compose.runtime:runtime-livedata than 1.8.2 is available: 1.9.4
⚠️	libs/SalesforceSDK/build.gradle.kts#L43 - A newer version of androidx.compose.ui:ui-tooling-preview-android than 1.8.2 is available: 1.9.4
⚠️	libs/SalesforceSDK/build.gradle.kts#L44 - A newer version of androidx.compose.material:material than 1.8.2 is available: 1.9.4
⚠️	libs/SalesforceSDK/build.gradle.kts#L46 - A newer version of androidx.compose.ui:ui-tooling than 1.8.2 is available: 1.9.4
⚠️	libs/SalesforceSDK/build.gradle.kts#L47 - A newer version of androidx.compose.ui:ui-test-manifest than 1.8.2 is available: 1.9.4
⚠️	libs/SalesforceSDK/build.gradle.kts#L53 - A newer version of androidx.compose.ui:ui-test-junit4 than 1.8.2 is available: 1.9.4
⚠️	libs/SalesforceSDK/build.gradle.kts#L54 - A newer version of io.mockk:mockk-android than 1.14.0 is available: 1.14.6

Generated by 🚫 Danger

github-actions · 2025-11-10T21:44:27Z

libs/SalesforceSDK/build.gradle.kts

+    implementation("androidx.lifecycle:lifecycle-service:$lifecycleVersion")
    implementation("org.jetbrains.kotlinx:kotlinx-serialization-json:1.6.3") // Update requires Kotlin 2.
    implementation("androidx.window:window:1.4.0")
    implementation("androidx.window:window-core:1.4.0")


⚠️ A newer version of androidx.window:window-core than 1.4.0 is available: 1.5.0

github-actions · 2025-11-10T21:44:53Z

	2 Warnings
⚠️	libs/SalesforceReact/build.gradle.kts#L25 - A newer version of com.facebook.react:react-android than 0.79.3 is available: 0.82.1
⚠️	libs/SalesforceReact/build.gradle.kts#L26 - A newer version of androidx.core:core-ktx than 1.16.0 is available: 1.17.0

Generated by 🚫 Danger

codecov · 2025-11-10T22:10:45Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 56.41%. Comparing base (28c0d83) to head (e467cee).
⚠️ Report is 6 commits behind head on dev.

Additional details and impacted files

@@             Coverage Diff              @@
##                dev    #2800      +/-   ##
============================================
+ Coverage     56.16%   56.41%   +0.25%     
- Complexity     2490     2507      +17     
============================================
  Files           211      211              
  Lines         16928    16919       -9     
  Branches       2376     2369       -7     
============================================
+ Hits           9507     9545      +38     
+ Misses         6377     6329      -48     
- Partials       1044     1045       +1

Components	Coverage Δ
Analytics	`47.92% <ø> (ø)`
SalesforceSDK	`44.22% <ø> (+0.03%)`	⬆️
Hybrid	`59.05% <ø> (ø)`
SmartStore	`78.20% <ø> (ø)`
MobileSync	`78.87% <ø> (ø)`
React	`52.36% <ø> (+5.41%)`	⬆️
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

JohnsonEricAtSalesforce · 2025-11-10T22:38:25Z

.github/workflows/reusable-workflow.yaml

      - uses: gradle/actions/setup-gradle@v4
        with:
-          gradle-version: "8.10.1"
+          gradle-version: "8.12.0"


Since this was reviewed on Friday, Gradle and AGP have been updated.

For future reference, this is the Gradle version not the AGP version. There is no version 8.12.0 so this is causing build failures.

JohnsonEricAtSalesforce · 2025-11-10T22:39:09Z

libs/SalesforceReact/build.gradle.kts

    testNamespace = "com.salesforce.androidsdk.reactnative.tests"

-    //noinspection GradleDependency - Will be upgraded to 36 in Mobile SDK 14.0
+    //noinspection GradleDependency - Will be upgraded to 36 in Mobile SDK 14.0.  Also, React Native 0.82.1 requests 36.


I added this note since we're temporarily diverging from the React Native Upgrade Assistant on this one.

… Community CLI (RCE) (Remove App Level React Native Dependencies)

JohnsonEricAtSalesforce · 2025-11-10T22:41:11Z

libs/SalesforceSDK/build.gradle.kts

 dependencies {
    val composeVersion = "1.8.2" // Update requires Kotlin 2.
-    val livecycleVersion = "2.8.7" // Update requires Kotlin 2.
+    val lifecycleVersion = "2.8.7" // Update requires Kotlin 2.


I believe this little typo was mine years ago, so I added it here as an unrelated fix.

… Community CLI (RCE) (Revert To React Native 0.81.5)

wmathurin · 2025-11-13T00:45:24Z

libs/SalesforceReact/package.json

-    "react-native-force": "git+https://github.com/forcedotcom/SalesforceMobileSDK-ReactNative.git#dev"
+    "react": "19.1.0",
+    "react-native": "0.81.5",
+    "react-native-force": "git+https://github.com/JohnsonEricAtSalesforce/SalesforceMobileSDK-ReactNative.git#bugfix/w-20151632_msdk-android-security-bug-cve-2025-11953-react-native-community-cli-rce"


Don't forget to revert that :-)

… Community CLI (RCE) (Self Review Cleanup)

… Community CLI (RCE) (Gradle Wrapper Update)

@W-20151632: MSDK Android Security Bug: CVE-2025-11953 - React Native…

8885dc3

… Community CLI (RCE)

JohnsonEricAtSalesforce requested a review from wmathurin November 6, 2025 23:48

JohnsonEricAtSalesforce self-assigned this Nov 6, 2025

JohnsonEricAtSalesforce commented Nov 6, 2025

View reviewed changes

brandonpage approved these changes Nov 6, 2025

View reviewed changes

@W-20151632: MSDK Android Security Bug: CVE-2025-11953 - React Native…

b2c60ae

… Community CLI (RCE) (Gradle and Android Gradle Plug In Updates)

github-actions bot reviewed Nov 10, 2025

View reviewed changes

JohnsonEricAtSalesforce commented Nov 10, 2025

View reviewed changes

@W-20151632: MSDK Android Security Bug: CVE-2025-11953 - React Native…

d81bd2d

… Community CLI (RCE) (Remove App Level React Native Dependencies)

JohnsonEricAtSalesforce commented Nov 10, 2025

View reviewed changes

@W-20151632: MSDK Android Security Bug: CVE-2025-11953 - React Native…

68c00e6

… Community CLI (RCE) (Revert To React Native 0.81.5)

wmathurin reviewed Nov 13, 2025

View reviewed changes

wmathurin approved these changes Nov 13, 2025

View reviewed changes

JohnsonEricAtSalesforce added 2 commits November 13, 2025 16:59

@W-20151632: MSDK Android Security Bug: CVE-2025-11953 - React Native…

39aa7b2

… Community CLI (RCE) (Self Review Cleanup)

@W-20151632: MSDK Android Security Bug: CVE-2025-11953 - React Native…

e467cee

… Community CLI (RCE) (Gradle Wrapper Update)

JohnsonEricAtSalesforce merged commit ae66239 into forcedotcom:dev Nov 17, 2025
19 of 21 checks passed

JohnsonEricAtSalesforce deleted the bugfix/w-20151632_msdk-android-security-bug-cve-2025-11953-react-native-community-cli-rce branch November 17, 2025 23:54

@W-20151632: MSDK Android Security Bug: CVE-2025-11953 - React Native Community CLI (RCE) #2800

@W-20151632: MSDK Android Security Bug: CVE-2025-11953 - React Native Community CLI (RCE) #2800

Uh oh!

Conversation

JohnsonEricAtSalesforce commented Nov 6, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot Nov 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot Nov 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot Nov 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot Nov 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot Nov 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot Nov 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot Nov 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot Nov 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot Nov 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Nov 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot Nov 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Nov 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Nov 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

github-actions bot Nov 10, 2025 •

edited

Loading

github-actions bot Nov 10, 2025 •

edited

Loading

github-actions bot Nov 10, 2025 •

edited

Loading

github-actions bot Nov 10, 2025 •

edited

Loading

github-actions bot Nov 10, 2025 •

edited

Loading

github-actions bot Nov 10, 2025 •

edited

Loading

github-actions bot Nov 10, 2025 •

edited

Loading

github-actions bot Nov 10, 2025 •

edited

Loading

github-actions bot Nov 10, 2025 •

edited

Loading

github-actions bot commented Nov 10, 2025 •

edited

Loading

github-actions bot Nov 10, 2025 •

edited

Loading

github-actions bot commented Nov 10, 2025 •

edited

Loading

codecov bot commented Nov 10, 2025 •

edited

Loading