CVE-2025-11953

9.8

CRITICAL CVSS 3.1

React Native Community CLI OS Command Injection Vulnerability - [Actively Exploited]

Description

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.

INFO

Published Date :

Nov. 3, 2025, 5:15 p.m.

Last Modified :

Feb. 6, 2026, 7:43 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Feb 26, 2026 | 11 days left

Alert Date: Feb 05, 2026 | 9 days ago

Description :

React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes :

This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: ; https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547;https://github.com/react-native-community/cli/pull/2735 ; https://nvd.nist.gov/vuln/detail/CVE-2025-11953

Affected Products

The following products are affected by CVE-2025-11953 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	React-native-community	react_native_community_cli

: Total Affected Vendor : 1 | Products : 1

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	CRITICAL				48a46f29-ae42-4e1d-90dd-c1676c1e5e6d
	CVSS 3.1	CRITICAL				[email protected]

Solution

Restrict Metro Development Server access and update React Native CLI to mitigate OS command injection.

Configure the server to bind only to localhost.
Update the React Native CLI to the latest version.
Restrict network access to the development server.
Disable the development server when not in use.

Public PoC/Exploit Available at Github

CVE-2025-11953 has a 9 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-11953.

URL	Resource
https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547	Patch
https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability	Exploit Mitigation Third Party Advisory
https://x.com/SzymonRybczak/status/1986199665000566848	Third Party Advisory
https://x.com/thymikee/status/1986770875954475375	Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11953	US Government Resource
https://www.vulncheck.com/blog/metro4shell_eitw	Exploit Third Party Advisory

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-11953 is associated with the following CWEs:

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-11953 weaknesses.

CAPEC-6: Argument Injection Argument Injection CAPEC-15: Command Delimiters Command Delimiters CAPEC-43: Exploiting Multiple Input Interpretation Layers Exploiting Multiple Input Interpretation Layers CAPEC-88: OS Command Injection OS Command Injection CAPEC-108: Command Line Execution through SQL Injection Command Line Execution through SQL Injection

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

lucacapacci/PoC-in-GitHub

Mirror of https://github.com/nomi-sec/PoC-in-GitHub

Updated: 5 days, 21 hours ago

0 stars 0 fork 0 watcher

Born at : Feb. 7, 2026, 10:02 a.m. This repo has been linked 789 different CVEs too.

boroeurnprach/CVE-2025-11953-PoC

CVE-2025-11953 - The React Native Metro server's default external binding exposes a vulnerable endpoint, allowing unauthenticated attackers to execute arbitrary OS commands via a malicious POST request.

JavaScript Python

Updated: 3 weeks, 3 days ago

0 stars 0 fork 0 watcher

Born at : Jan. 15, 2026, 9:46 a.m. This repo has been linked 1 different CVEs too.

Mr-In4inci3le/CVE-2025-11953-POC-

None

JavaScript

Updated: 1 month ago

0 stars 0 fork 0 watcher

Born at : Jan. 12, 2026, 9:53 a.m. This repo has been linked 1 different CVEs too.

N3k0t-dev/PoC-CVE-collection

Comprehensive Proof of Concept collection for CVE-2025-11953, CVE-2025-59287, CVE-2025-8941 with exploitation frameworks in Python, C, Bash, PowerShell

Shell Python

Updated: 3 months ago

0 stars 1 fork 1 watcher

Born at : Nov. 10, 2025, 10:09 p.m. This repo has been linked 3 different CVEs too.

B1ack4sh/Blackash-CVE-2025-11953

CVE-2025-11953

Updated: 3 months, 1 week ago

1 stars 0 fork 0 watcher

Born at : Nov. 5, 2025, 9:11 a.m. This repo has been linked 1 different CVEs too.

SaidBenaissa/cve-2025-11953-vulnerability-demo

CVE-2025-11953 demonstration: Critical RCE vulnerability in React Native CLI (CVSS 9.8). Educational security research with proof-of-concept exploits and mitigation strategies.

Shell PowerShell JavaScript

Updated: 3 months, 1 week ago

2 stars 1 fork 1 watcher

Born at : Nov. 4, 2025, 5:57 p.m. This repo has been linked 1 different CVEs too.

AnkitDevCode/Rss-Feed

None

HTML

Updated: 1 week, 3 days ago

0 stars 0 fork 0 watcher

Born at : Sept. 5, 2025, 5:58 p.m. This repo has been linked 1 different CVEs too.

zulloper/cve-poc

CVE POC repo 자동 수집기

Python

Updated: 1 month ago

5 stars 2 fork 2 watcher

Born at : June 8, 2025, 3:07 p.m. This repo has been linked 215 different CVEs too.

evva-sfw/abrevva-react-native

Collection of tools to work with electronic EVVA access components - for React Native development.

Kotlin JavaScript Ruby Objective-C Objective-C++ TypeScript Swift Makefile

Updated: 1 week, 3 days ago

1 stars 1 fork 1 watcher

Born at : July 24, 2024, 8:09 a.m. This repo has been linked 1 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-11953 vulnerability anywhere in the article.

CybersecurityNews

Cybersecurity Weekly Newsletter – Notepad++ hack, Office 0-Day, ESXi 0-day Ransomware Attacks and More

Cybersecurity Newsletter Weekly February Welcome to this week’s pulse on the cyber threat landscape, where vulnerabilities strike fast, and defenders must move faster. Notepad++ users face a supply-ch ...

Published Date: Feb 08, 2026 (6 days, 3 hours ago)

TheCyberThrone

CISA Adds SmarterMail and React Native CLI Flaws to KEV Catalog

February 6, 2026U.S. CISA has escalated two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, signaling active exploitation in the wild. CVE-2026-24423 in SmarterTools Sma ...

Published Date: Feb 06, 2026 (1 week, 1 day ago)

CybersecurityNews

CISA Warns of React Native Community Command Injection Vulnerability Exploited in Attacks

React Native Command Injection Flaw The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-11953 to its Known Exploited Vulnerabilities (KEV) catalog, flagging an OS comma ...

Published Date: Feb 06, 2026 (1 week, 1 day ago)

Daily CyberSecurity

Silent Intrusion: “Metro4Shell” Exploited in the Wild Since December

Image: VulCheck A new report from VulnCheck reveals that CVE-2025-11953, a critical flaw in the Metro development server dubbed “Metro4Shell,” was being actively weaponized in the wild as early as lat ...

Published Date: Feb 04, 2026 (1 week, 3 days ago)

The Register

Critical React Native Metro dev server bug under attack as researchers scream into the void

Baddies are exploiting a critical bug in React Native's Metro development server to deliver malware to both Windows and Linux machines, and yet the in-the-wild attacks still haven't received the "broa ...