Skip to content

@W-20151632: MSDK Android Security Bug: CVE-2025-11953 - React Native Community CLI (RCE) #2800

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JohnsonEricAtSalesforce merged 6 commits into from
Nov 17, 2025
Merged

@W-20151632: MSDK Android Security Bug: CVE-2025-11953 - React Native Community CLI (RCE) #2800

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
8885dc3
@W-20151632: MSDK Android Security Bug: CVE-2025-11953 - React Native…
JohnsonEricAtSalesforce Nov 6, 2025
b2c60ae
@W-20151632: MSDK Android Security Bug: CVE-2025-11953 - React Native…
JohnsonEricAtSalesforce Nov 10, 2025
d81bd2d
@W-20151632: MSDK Android Security Bug: CVE-2025-11953 - React Native…
JohnsonEricAtSalesforce Nov 10, 2025
68c00e6
@W-20151632: MSDK Android Security Bug: CVE-2025-11953 - React Native…
JohnsonEricAtSalesforce Nov 13, 2025
39aa7b2
@W-20151632: MSDK Android Security Bug: CVE-2025-11953 - React Native…
JohnsonEricAtSalesforce Nov 13, 2025
e467cee
@W-20151632: MSDK Android Security Bug: CVE-2025-11953 - React Native…
JohnsonEricAtSalesforce Nov 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/reusable-workflow.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ jobs:
uses: android-actions/setup-android@v3
- uses: gradle/actions/setup-gradle@v4
with:
gradle-version: "8.10.1"
gradle-version: "8.12.0"
Copy link
Contributor Author

@JohnsonEricAtSalesforce JohnsonEricAtSalesforce Nov 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since this was reviewed on Friday, Gradle and AGP have been updated.

Copy link
Contributor

@brandonpage brandonpage Nov 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For future reference, this is the Gradle version not the AGP version. There is no version 8.12.0 so this is causing build failures.

add-job-summary: on-failure
add-job-summary-as-pr-comment: on-failure
- name: Run Lint
Expand Down
2 changes: 1 addition & 1 deletion build.gradle.kts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ buildscript {
}

dependencies {
classpath("com.android.tools.build:gradle:8.10.1")
classpath("com.android.tools.build:gradle:8.12.0")
classpath("io.github.gradle-nexus:publish-plugin:2.0.0")
classpath("org.jetbrains.kotlin:kotlin-gradle-plugin:1.9.24")
classpath("org.jacoco:org.jacoco.core:0.8.13")
Expand Down
2 changes: 1 addition & 1 deletion buildSrc/build.gradle.kts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ repositories {
}

dependencies {
implementation("com.android.tools.build:gradle:8.10.1")
implementation("com.android.tools.build:gradle:8.12.0")
implementation("org.jetbrains.kotlin:kotlin-gradle-plugin:1.9.24")
implementation("org.jetbrains.kotlin:kotlin-stdlib:2.0.21")
}
Binary file modified gradle/wrapper/gradle-wrapper.jar
View file
Open in desktop
Binary file not shown.
2 changes: 1 addition & 1 deletion gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.2-bin.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.3-bin.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
25 changes: 14 additions & 11 deletions gradlew
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

26 changes: 14 additions & 12 deletions gradlew.bat
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion libs/SalesforceReact/build.gradle.kts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ android {
namespace = "com.salesforce.androidsdk.reactnative"
testNamespace = "com.salesforce.androidsdk.reactnative.tests"

//noinspection GradleDependency - Will be upgraded to 36 in Mobile SDK 14.0
//noinspection GradleDependency - Will be upgraded to 36 in Mobile SDK 14.0. Also, React Native 0.81.5 requests 36.
compileSdk = 35

defaultConfig {
Expand Down
28 changes: 14 additions & 14 deletions libs/SalesforceReact/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,34 +9,34 @@
"@babel/plugin-transform-private-property-in-object": "^7.24.7",
"create-react-class": "^15.7.0",
"jsc-android": "^250231.0.0",
"react": "19.0.0",
"react-native": "0.79.3",
"react": "19.1.0",
"react-native": "0.81.5",
"react-native-force": "git+https://github.com/forcedotcom/SalesforceMobileSDK-ReactNative.git#dev"
},
"devDependencies": {
"@babel/core": "^7.25.2",
"@babel/preset-env": "^7.25.3",
"@babel/runtime": "^7.25.0",
"@react-native-community/cli": "18.0.0",
"@react-native-community/cli-platform-android": "18.0.0",
"@react-native-community/cli-platform-ios": "18.0.0",
"@react-native/babel-preset": "0.79.3",
"@react-native/eslint-config": "0.79.3",
"@react-native/metro-config": "0.79.3",
"@react-native/typescript-config": "0.79.3",
"@react-native-community/cli": "20.0.0",
"@react-native-community/cli-platform-android": "20.0.0",
"@react-native-community/cli-platform-ios": "20.0.0",
"@react-native/babel-preset": "0.81.5",
"@react-native/eslint-config": "0.81.5",
"@react-native/metro-config": "0.81.5",
"@react-native/typescript-config": "0.81.5",
"@types/jest": "^29.5.13",
"@types/react": "^19.0.0",
"@types/react-test-renderer": "^19.0.0",
"@types/react": "^19.1.0",
"@types/react-test-renderer": "^19.1.0",
"babel-jest": "^30.0.0",
"chai": "4.4.1",
"eslint": "^8.19.0",
"jest": "^29.6.3",
"metro-react-native-babel-preset": "0.77.0",
"prettier": "2.8.8",
"react-test-renderer": "19.0.0",
"typescript": "5.0.4"
"react-test-renderer": "19.1.0",
"typescript": "^5.8.3"
},
"engines": {
"node": ">=18"
"node": ">=20"
Copy link
Contributor

@brandonpage brandonpage Nov 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need to update the versions spreadsheet so this new min version gets added to release notes.

}
}
10 changes: 5 additions & 5 deletions libs/SalesforceSDK/build.gradle.kts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ plugins {

dependencies {
val composeVersion = "1.8.2" // Update requires Kotlin 2.
val livecycleVersion = "2.8.7" // Update requires Kotlin 2.
val lifecycleVersion = "2.8.7" // Update requires Kotlin 2.
Copy link
Contributor Author

@JohnsonEricAtSalesforce JohnsonEricAtSalesforce Nov 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe this little typo was mine years ago, so I added it here as an unrelated fix.

val androidXActivityVersion = "1.10.1"

api(project(":libs:SalesforceAnalytics"))
Expand All @@ -29,10 +29,10 @@ dependencies {
implementation("androidx.core:core-ktx:1.16.0") // Update requires API 36 compileSdk
Copy link

@github-actions github-actions bot Nov 10, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ A newer version of androidx.core:core-ktx than 1.16.0 is available: 1.17.0

implementation("androidx.activity:activity-ktx:$androidXActivityVersion")
Copy link

@github-actions github-actions bot Nov 10, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ A newer version of androidx.activity:activity-ktx than 1.10.1 is available: 1.11.0

implementation("androidx.activity:activity-compose:$androidXActivityVersion")
Copy link

@github-actions github-actions bot Nov 10, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ A newer version of androidx.activity:activity-compose than 1.10.1 is available: 1.11.0

implementation("androidx.lifecycle:lifecycle-viewmodel-ktx:$livecycleVersion")
implementation("androidx.lifecycle:lifecycle-viewmodel-compose:$livecycleVersion")
implementation("androidx.lifecycle:lifecycle-viewmodel-savedstate:$livecycleVersion")
implementation("androidx.lifecycle:lifecycle-service:$livecycleVersion")
implementation("androidx.lifecycle:lifecycle-viewmodel-ktx:$lifecycleVersion")
Copy link

@github-actions github-actions bot Nov 10, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ A newer version of androidx.lifecycle:lifecycle-viewmodel-ktx than 2.8.7 is available: 2.9.4

implementation("androidx.lifecycle:lifecycle-viewmodel-compose:$lifecycleVersion")
Copy link

@github-actions github-actions bot Nov 10, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ A newer version of androidx.lifecycle:lifecycle-viewmodel-compose than 2.8.7 is available: 2.9.4

implementation("androidx.lifecycle:lifecycle-viewmodel-savedstate:$lifecycleVersion")
Copy link

@github-actions github-actions bot Nov 10, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ A newer version of androidx.lifecycle:lifecycle-viewmodel-savedstate than 2.8.7 is available: 2.9.4

implementation("androidx.lifecycle:lifecycle-service:$lifecycleVersion")
Copy link

@github-actions github-actions bot Nov 10, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ A newer version of androidx.lifecycle:lifecycle-service than 2.8.7 is available: 2.9.4

implementation("org.jetbrains.kotlinx:kotlinx-serialization-json:1.6.3") // Update requires Kotlin 2.
Copy link

@github-actions github-actions bot Nov 10, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ A newer version of org.jetbrains.kotlinx:kotlinx-serialization-json than 1.6.3 is available: 1.9.0

implementation("androidx.window:window:1.4.0")
Copy link

@github-actions github-actions bot Nov 10, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ A newer version of androidx.window:window than 1.4.0 is available: 1.5.0

implementation("androidx.window:window-core:1.4.0")
Copy link

@github-actions github-actions bot Nov 10, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ A newer version of androidx.window:window-core than 1.4.0 is available: 1.5.0

Expand Down
Loading