CVE-2025-11953
React Native Community CLI OS Command Injection Vulnerability
Description
CVE-2025-11953 is a critical OS command injection vulnerability in the React Native Community CLI's Metro Development Server that allows unauthenticated remote attackers to execute arbitrary commands. With a CVSS v3.1 base score of 9.8, the flaw stems from the Metro server binding to external network interfaces by default and exposing an endpoint vulnerable to command injection via crafted POST requests. CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of February 26, 2026, and the ransomware association is currently classified as unknown. The EPSS score of 8.42% at the 92.2nd percentile places this among the most actively targeted developer tool vulnerabilities, indicating widespread exploitation attempts against development environments running the Metro server.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| react-native-community | react native community cli | >= 19.0.0, < 19.1.2; 18.0.0; 20.0.0 |
References
- https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547(Patch)
- https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability(Exploit, Mitigation, Third Party Advisory)
- https://x.com/SzymonRybczak/status/1986199665000566848(Third Party Advisory)
- https://x.com/thymikee/status/1986770875954475375(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11953(US Government Resource)
- https://www.vulncheck.com/blog/metro4shell_eitw(Exploit, Third Party Advisory)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-11953 is classified under CWE-78 (OS Command Injection). This weakness occurs when software constructs operating system commands using externally influenced input without proper neutralization of special elements that could modify the intended command. In the React Native Community CLI, the Metro Development Server accepts POST requests to an exposed endpoint and passes user-supplied data to the operating system shell without adequate sanitization. An attacker can inject shell metacharacters and command separators into the request payload, causing the server to execute arbitrary commands alongside or instead of the intended operation. On Windows systems, the exploitation is particularly severe because the attacker gains full control over shell command construction. OS command injection in development servers is especially dangerous because these servers often run with the developer's full user permissions and have access to source code, credentials, and deployment infrastructure. Learn more about CWE-78
Impact Analysis
The impact of CVE-2025-11953 is catastrophic across all dimensions of the CIA triad, as reflected in its maximum 9.8 CVSS score. Confidentiality is completely compromised because the attacker achieves arbitrary command execution with the permissions of the user running the Metro server, which is typically a developer with broad access to source code repositories, environment variables containing API keys and secrets, SSH keys, cloud provider credentials, and internal network resources. Developer machines frequently contain the most sensitive assets in an organization's software development lifecycle.
Integrity suffers maximum impact as the attacker can modify source code, inject backdoors into build artifacts, tamper with dependencies, alter CI/CD configurations, and commit malicious changes to version control systems. This represents a severe supply chain risk because compromised developer environments can propagate malicious code into production deployments that affect end users.
Availability faces critical risk as the attacker can terminate processes, destroy files, encrypt data, or use the compromised developer machine as a pivot point for lateral movement within the corporate network. The EPSS score of 8.42% at the 92.2nd percentile combined with the KEV listing confirms active exploitation in the wild. Public exploit documentation is available through JFrog's analysis and VulnCheck's research, indicating mature exploitation tooling. The affected versions include React Native Community CLI 19.0.0 through 19.1.1, version 18.0.0, and version 20.0.0, impacting a significant portion of the React Native development ecosystem.
Exploit Maturity
CVE-2025-11953 exhibits very high exploit maturity with extensive public documentation and confirmed in-the-wild exploitation. The EPSS score of 8.42% at the 92.2nd percentile places it among the top 8% of vulnerabilities by exploitation probability, and CISA's KEV listing with a remediation deadline of February 26, 2026 confirms active targeting. Multiple public exploit analyses are available: JFrog's detailed writeup provides exploitation details and mitigation guidance, while VulnCheck's "Metro4Shell" research documents exploitation in the wild. The patch commit is publicly available, allowing attackers to reverse-engineer the exact vulnerability mechanism.
The exploitation is straightforward: the Metro Development Server binds to all network interfaces (0.0.0.0) by default, making it accessible to any attacker on the same network or, in misconfigured environments, from the internet. The vulnerable endpoint accepts POST requests and passes input directly to OS command execution functions without sanitization. On Windows, the attacker gains full shell command execution capabilities. The combination of network accessibility, no authentication requirement, and trivial exploitation complexity makes this vulnerability an ideal target for both opportunistic scanning and targeted attacks against development teams. The ransomware association is unknown, but the level of access achieved is fully sufficient for ransomware deployment.
Remediation
-
Update the React Native Community CLI immediately to version 19.1.2 or later, which patches the command injection vulnerability. For projects using version 18.0.0, upgrade to a patched release. For version 20.0.0, check for the latest patched version. Review the patch commit to understand the specific changes applied.
-
Bind the Metro Development Server to localhost only as an immediate compensating control. Configure the Metro server to listen on 127.0.0.1 instead of 0.0.0.0 to prevent network-based exploitation. This can be done by setting the host configuration in your Metro or React Native project configuration files. This should be applied regardless of patching, as it follows the principle of least privilege for development servers.
-
Implement network segmentation for development environments to ensure that developer workstations running Metro servers are not directly reachable from untrusted network segments. Use host-based firewalls to block inbound connections to the Metro server port (default 8081) from any source other than localhost, and ensure that development machines are isolated from guest networks and public-facing infrastructure.
-
Audit development environments for signs of compromise by reviewing process execution logs on developer machines for unexpected commands, checking for unauthorized SSH keys or accounts, reviewing recent git commits for suspicious changes, and scanning for backdoors in build artifacts. Given the EPSS score and KEV listing, any environment running vulnerable versions should be treated as potentially compromised.
-
Rotate credentials and secrets accessible from developer machines that may have been running the vulnerable Metro server version. This includes API keys stored in environment variables, SSH keys, cloud provider credentials, npm/registry tokens, and any other secrets that the developer's session had access to.
Technical Details
CVE-2025-11953 is an OS command injection vulnerability in the React Native Community CLI's Metro Development Server, characterized by the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vector components paint a worst-case exploitation scenario: Attack Vector (AV:N) indicates network-based exploitation with no local access required. Attack Complexity (AC:L) confirms the exploit is trivially reliable with no special conditions. Privileges Required (PR:N) means no authentication is needed. User Interaction (UI:N) confirms fully automated exploitation. Scope (S:U) keeps impact within the Metro server process context, but since it runs as the developer user, this grants extensive access.
The Metro Development Server is the JavaScript bundler used during React Native application development. By default, it binds to all network interfaces (0.0.0.0), making it accessible to any device on the local network or, if port forwarding or cloud development environments are in use, from the internet. The server exposes HTTP endpoints for bundling, debugging, and development operations. The vulnerable endpoint accepts POST requests containing parameters that are passed to operating system command execution functions without proper input sanitization. On Linux and macOS, the attacker can inject commands using shell metacharacters such as semicolons, backticks, or pipe operators. On Windows, the exploitation is even more severe because the attacker can construct fully controlled shell commands through the vulnerable parameter.
The affected versions are React Native Community CLI 19.0.0 through versions prior to 19.1.2, version 18.0.0, and version 20.0.0. The fix in version 19.1.2 addresses the root cause by properly sanitizing input before it reaches OS command execution paths and by implementing stricter validation of the parameters accepted by the vulnerable endpoint. The patch also addresses the default binding behavior to reduce the attack surface of the development server.
Frequently Asked Questions
What is CVE-2025-11953?
CVE-2025-11953 is a critical OS command injection vulnerability in the React Native Community CLI's Metro Development Server. It allows unauthenticated network attackers to execute arbitrary commands on the developer's machine by sending a crafted POST request to the server, which has a CVSS score of 9.8.
Am I affected if I use React Native?
You are affected if you use React Native Community CLI versions 19.0.0 through 19.1.1, version 18.0.0, or version 20.0.0. Check your project's package.json or lock file for the @react-native-community/cli package version. Update to version 19.1.2 or later immediately.
Can this vulnerability be exploited over the internet?
Yes, if the Metro Development Server is accessible from the internet, which can happen with cloud development environments, port forwarding, or misconfigured firewalls. Even on local networks, any device on the same network can exploit the vulnerability because Metro binds to all interfaces by default.
What should I do if my development machine was running a vulnerable version?
Update the CLI immediately, then audit your development environment for signs of compromise. Rotate all credentials and secrets accessible from the machine, review recent code commits for unauthorized changes, and scan for backdoors. Given the high EPSS score and active exploitation, treat exposed environments as potentially compromised.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.