React Native Community · CLI
The React Native Community CLI's Metro Development Server contains an OS command injection flaw in an exposed endpoint, and the server binds to external interfaces by default. An unauthenticated attacker on the network can send a POST request to that endpoint to run arbitrary executables, and on Windows can also run arbitrary shell commands with fully controlled arguments, with no user interaction or configuration change required.
The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.
First seen exploited 3 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 1 day after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Unauthenticated network POST to exposed server
exposes an endpoint that is vulnerable to OS command injection
Arbitrary executable execution via command injection
allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
2 packages in 1 ecosystem. Main package: @react-native-community/cli.
Upgrade to 20.0.0 or later
npm install @react-native-community/cli@20.0.0The first fix for CVE-2025-11953. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| 20.0.0-alpha.0 up to 20.0.0 | 20.0.0 |
| 19.0.0-alpha.0 up to 19.1.2 | 19.1.2 |
| 18.0.0 up to 18.0.1 | 18.0.1 |
“Up to” means the second version is the fix and is not affected.
Forks, repackagings and products that include the affected code. Each has its own fixed version.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.