Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseGHSA-7cjh-xx4r-qh3f
GHSA-7cjh-xx4r-qh3f:
Java vulnerability analysis and mitigation
Overview
The vulnerability (GHSA-7cjh-xx4r-qh3f) affects the sentry-android SDK versions prior to 8.14.0, specifically impacting applications using Jetpack Compose version 1.8.0-alpha08 or later with Session Replays enabled. The issue was discovered in May 2025 and was patched with the release of sentry-android SDK version 8.14.0 on June 17, 2025 (GitHub Advisory).
Technical details
The vulnerability stems from a change in Jetpack Compose 1.8+ where LayoutNode.collapsedSemantics was removed in favor of LayoutNode.getSemanticsConfiguration(). This change caused the SDK to fail in properly masking sensitive data in text composables during Android Session Replays. The vulnerability has been assigned a high severity rating with a CVSS score of 8.2, characterized by network attack vector, low attack complexity, and high confidentiality impact (GitHub Advisory).
Impact
When exploited, the vulnerability exposes unmasked sensitive data in Android Session Replays for applications using the affected versions. This primarily affects text composables that should have been masked but were exposed in session recordings, potentially leading to unauthorized access to sensitive information (GitHub Advisory).
Mitigation and workarounds
The primary mitigation is to upgrade the sentry-android SDK to version 8.14.0. For cases where immediate upgrade isn't possible, two workarounds are available: downgrade Jetpack Compose to version 1.7.x or lower, or set session sample rates to 0.0 using options.sessionReplay.onErrorSampleRate and options.sessionReplay.sessionSampleRate. Users who have confirmed exposure of sensitive data can delete individual replays or contact Sentry support for bulk deletion (GitHub Advisory, Sentry Release).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management