GHSA-399j-vxmf-hjvr
@react-native-community/cli has arbitrary OS command injection
At a glance
- Published
- Updated
- CVE
- CVE-2025-11953
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
The Metro Development Server, which is opened by the React Native CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.
Affected packages
| Package | Versions |
|---|---|
| npm · @react-native-community/cli | introduced 20.0.0-alpha.0, fixed 20.0.0 |
| npm · @react-native-community/cli | introduced 19.0.0-alpha.0, fixed 19.1.2 |
| npm · @react-native-community/cli | introduced 18.0.0, fixed 18.0.1 |
| npm · @react-native-community/cli-server-api | introduced 20.0.0-alpha.0, fixed 20.0.0 |
| npm · @react-native-community/cli-server-api | introduced 19.0.0-alpha.0, fixed 19.1.2 |
| npm · @react-native-community/cli-server-api | introduced 18.0.0, fixed 18.0.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-11953 ADVISORY
- https://github.com/react-native-community/cli/issues/2733#issuecomment-3502424164 WEB
- https://github.com/react-native-community/cli/pull/1615 WEB
- https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547 WEB
- https://github.com/react-native-community/cli/commit/5a792169d9883e0b0fb1ddf1ea46778f21510d18 WEB
- https://github.com/react-native-community/cli/commit/9e1fa8cc633e5dcf32244ffa60a871880be56722 WEB
- https://github.com/react-native-community/cli/commit/a8293dc29425f56249753507bc24d87b698d46e1 WEB
- https://github.com/react-native-community/cli PACKAGE
- https://github.com/react-native-community/cli/releases/tag/v20.0.0 WEB
- https://github.com/react-native-community/cli?tab=readme-ov-file#compatibility WEB
- https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability WEB
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11953 WEB
- https://www.vulncheck.com/blog/metro4shell_eitw WEB
- https://x.com/SzymonRybczak/status/1986199665000566848 WEB
- https://x.com/szymonrybczak/status/1986199665000566848?s=46 WEB
- https://x.com/thymikee/status/1986770875954475375 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |