CVE-2025-11953

9.5 CISA KEV

React Native Community · CLI

The Metro development server in React Native Community CLI is vulnerable to unauthenticated OS command injection via the open-url endpoint, allowing remote code execution.

Executive summary

This critical vulnerability in the React Native Community CLI is being actively exploited in the wild and allows unauthenticated attackers to execute arbitrary OS commands on developer machines.

Vulnerability

The Metro development server binds to external network interfaces by default and contains an insecure endpoint that passes unsanitized user input to an OS command execution function. This allows an unauthenticated network attacker to send a specially crafted POST request to trigger arbitrary command execution.

Business impact

Successful exploitation allows an attacker to gain full control over the developer workstation or build server running the CLI. This poses a severe risk of intellectual property theft, injection of malicious code into software build pipelines (supply chain compromise), and lateral movement within the corporate network. The high CVSS score of 9.5 reflects the critical nature of this remote code execution flaw.

Remediation

Immediate Action: Update the @react-native-community/cli and @react-native-community/cli-server-api packages to version 20.0.0 or higher immediately.

Proactive Monitoring: Audit developer workstations and build environments for unexpected network connections originating from the Metro development server, particularly on port 8081.

Compensating Controls: If an immediate update is not feasible, enforce network security by binding the development server exclusively to the local loopback interface using the flag --host 127.0.0.1.

Exploitation status

Public Exploit Available: Yes, a Nuclei detection template exists and multiple proof-of-concept repositories have been published on GitHub.

Analyst recommendation

Given the confirmed active exploitation and the high risk of supply chain contamination, this vulnerability must be treated with the highest priority. All development environments using the affected CLI versions should be patched to version 20.0.0 immediately. If patching cannot be performed instantly, ensure all development servers are restricted to the local host interface to prevent remote access.

More React Native Community CVEs

History

  1. Disclosed CVE record published
  2. Published in the daily brief critical section
  3. Published in the daily brief critical section
  4. Published in the daily brief kev section
  5. Published in the daily brief kev section
  6. Published in the daily brief kev section
  7. Published in the daily brief kev section
  8. Published in the daily brief kev section
  9. Published in the daily brief kev section
  10. Published in the daily brief kev section
  11. Published in the daily brief kev section
  12. Published in the daily brief kev section
  13. Published in the daily brief kev section
  14. Published in the daily brief kev section
  15. Published in the daily brief kev section
  16. Published in the daily brief kev section
  17. Published in the daily brief kev section
  18. Published in the daily brief kev section
  19. Published in the daily brief kev section
  20. Published in the daily brief kev section
  21. Published in the daily brief kev section
  22. Published in the daily brief kev section
  23. Published in the daily brief kev section
  24. Analyst report written
  25. Fix documented version 20.0.0 per CVE record

Sources