by Kastro
Paper/Archive/CVE-2025-11953

CVE-2025-11953

React Native Community CLI — Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests

KEV · due 26 FebEPSS 94%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (CNA)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 99.8.998 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.

Affected

ProductAffectedFixed inSource
@react-native-community/cli-server-api4.8.0 – < 20.0.020.0.0CNA

Scores by source

JFROG (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

writeupjfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerabilitypatchgithub.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547writeupvulncheck.com/blog/metro4shell_eitwrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11953refx.com/SzymonRybczak/status/1986199665000566848refx.com/thymikee/status/1986770875954475375kevcisa.gov/known-exploited-vulnerabilities-catalog