The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.
References
| Link | Resource |
|---|---|
| https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547 | Patch |
| https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability | Exploit Mitigation Third Party Advisory |
| https://x.com/SzymonRybczak/status/1986199665000566848 | Third Party Advisory |
| https://x.com/thymikee/status/1986770875954475375 | Third Party Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11953 | US Government Resource |
| https://www.vulncheck.com/blog/metro4shell_eitw | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
06 Feb 2026, 19:43
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:react-native-community:react_native_community_cli:18.0.0:*:*:*:*:*:*:* |
06 Feb 2026, 16:38
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547 - Patch | |
| References | () https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability - Exploit, Mitigation, Third Party Advisory | |
| References | () https://x.com/SzymonRybczak/status/1986199665000566848 - Third Party Advisory | |
| References | () https://x.com/thymikee/status/1986770875954475375 - Third Party Advisory | |
| References | () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11953 - US Government Resource | |
| References | () https://www.vulncheck.com/blog/metro4shell_eitw - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:react-native-community:react_native_community_cli:20.0.0:alpha0:*:*:*:*:*:* cpe:2.3:a:react-native-community:react_native_community_cli:*:*:*:*:*:*:*:* cpe:2.3:a:react-native-community:react_native_community_cli:20.0.0:alpha1:*:*:*:*:*:* cpe:2.3:a:react-native-community:react_native_community_cli:20.0.0:alpha2:*:*:*:*:*:* |
|
| First Time |
React-native-community
React-native-community react Native Community Cli |
05 Feb 2026, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
11 Nov 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
03 Nov 2025, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments. |
03 Nov 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-03 17:15
Updated : 2026-02-06 19:43
NVD link : CVE-2025-11953
Mitre link : CVE-2025-11953
CVE.ORG link : CVE-2025-11953
JSON object : View
Products Affected
react-native-community
- react_native_community_cli
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')