CVE-2024-25466: 
JavaScript vulnerability analysis and mitigation

Directory Traversal vulnerability affects React Native Document Picker before version 9.1.1 and was fixed in version 9.1.1. The vulnerability was discovered in February 2024 and allows a local attacker to execute arbitrary code via a crafted script targeting the Android library component (NVD, GitHub).

The vulnerability exists in the Android library component of React Native Document Picker, specifically in the RNDocumentPickerModule.java file. The CVSS v3.1 base score is 7.3 (High), with the vector string AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H, indicating local access vector, low attack complexity, no privileges required, and user interaction required (GitHub).

If successfully exploited, this vulnerability can lead to arbitrary code execution and privilege escalation on the affected system. The impact includes potential unauthorized access to sensitive data and system compromise through the Android library component (GitHub).

To exploit this vulnerability, an attacker must have local access to the system and the user must choose a maliciously configured application while picking a file. The vulnerability has been confirmed by the vendor (GitHub).

The vulnerability has been patched in React Native Document Picker version 9.1.1. Users are advised to upgrade to this version or later to mitigate the risk (NVD).