PT-2025-44787 · Unknown · React Native Community Cli+1

Published 2025-08-04 · Updated 2026-05-21 · CVE-2025-11953

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions @react-native-community/cli-server-api versions 4.8.0 through 20.0.0-alpha.2 @react-native-community/cli versions 4.8.0 through 20.0.0-alpha.2

Description An OS command injection flaw exists in the Metro Development Server, which is opened by the React Native Community CLI. The server binds to external interfaces by default, allowing unauthenticated network attackers to send a specially crafted POST request to the '/open-url' endpoint. The vulnerability occurs because the url parameter in the request body is passed to the open() function without proper validation or sanitization. On Windows, this allows for the execution of arbitrary shell commands with fully controlled arguments. On Linux and macOS, it can lead to the execution of arbitrary executables or the exploitation of URI schemes (such as file://). Approximately 3,500 unprotected servers have been identified globally. Real-world exploitation has been observed since December 2025, where attackers used the flaw to disable Microsoft Defender via the Add-MpPreference command and deploy Rust-based malware on Windows and Linux workstations.

Recommendations Update @react-native-community/cli-server-api and @react-native-community/cli to version 20.0.0 or later. As a temporary workaround, start the Metro server bound only to localhost by using the command npx react-native start --host 127.0.0.1 to block external access. Restrict access to the '/open-url' endpoint using IDS/WAF rules to block POST requests where the url parameter does not start with http:// or https://.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2026-01467

CVE-2025-11953

GHSA-399J-VXMF-HJVR

Affected Products

Metro Development Server

React Native Community Cli

References · 131

• 🔥 https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability · Exploit
• 🔥 https://vulncheck.com/blog/metro4shell_eitw · Exploit
• https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-11953 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11953 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-01467 · Security Note
• https://osv.dev/vulnerability/GHSA-399j-vxmf-hjvr · Vendor Advisory
• https://github.com/react-native-community/cli/issues/2733#issuecomment-3502424164 · Note
• https://github.com/react-native-community/cli/commit/5a792169d9883e0b0fb1ddf1ea46778f21510d18 · Note
• https://github.com/react-native-community/cli?tab=readme-ov-file#compatibility · Note
• https://github.com/react-native-community/cli/releases/tag/v20.0.0 · Note
• https://github.com/react-native-community/cli/commit/9e1fa8cc633e5dcf32244ffa60a871880be56722 · Note
• https://github.com/react-native-community/cli · Note
• https://github.com/react-native-community/cli/commit/a8293dc29425f56249753507bc24d87b698d46e1 · Note
• https://github.com/react-native-community/cli/pull/1615 · Note