CRITICAL

CVE-2025-11953

React-native-community React Native Community Cli 2025-11-03 CVSS v3.1

CVSS

9.8

KEV

Description

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.

Summary dbcve.org

The Metro Development Server in React Native Community CLI binds to external network interfaces by default and contains an OS command injection vulnerability in a POST endpoint. This allows unauthenticated remote attackers to execute arbitrary executables and shell commands (on Windows) without any authentication.

Mitigation

Restrict Metro server to localhost binding only (e.g., using --host localhost or configuring metro.config.js), and implement network access controls to prevent external access to development server ports.

Proof of Concept

Patch Commit

Weakness (CWE)

CWE-78 OS Command Injection

EPSS Score

93.98%

Probability of exploitation in next 30 days

99.8th percentile

References

https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547 Patch https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability Exploit, Mitigation, Third Party Advisory https://x.com/SzymonRybczak/status/1986199665000566848 Third Party Advisory https://x.com/thymikee/status/1986770875954475375 Third Party Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11953 US Government Resource https://www.vulncheck.com/blog/metro4shell_eitw Exploit, Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE