PT-2025-44787 · Unknown · Metro Development Server+1

Published 2025-08-04 · Updated 2026-03-24 · CVE-2025-11953

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions React Native Community CLI versions 4.8.0 through 20.0.0-alpha.2

Description The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments. Active exploitation of this vulnerability, dubbed "Metro4Shell" (CVE-2025-11953), has been observed in the wild, with attackers deploying PowerShell loaders to disable Microsoft Defender and deliver Rust-based malware. Approximately 3,500 servers are estimated to be exposed. The vulnerability resides in the /open-url endpoint, where the url parameter is passed to the open() function without proper validation. This allows attackers to execute commands on the system.

Recommendations React Native Community CLI versions prior to 20.0.0 are vulnerable. Update to version 20.0.0 or later to address this vulnerability. If updating is not immediately possible, bind the Metro server to localhost (127.0.0.1) to prevent external access. Implement network segmentation to isolate development environments. Monitor for anomalous POST requests to the /open-url endpoint.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2026-01467

CVE-2025-11953

GHSA-399J-VXMF-HJVR

Affected Products

Metro Development Server

React Native Community Cli

References · 127

• 🔥 https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability · Exploit
• 🔥 https://vulncheck.com/blog/metro4shell_eitw · Exploit
• https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547 · Patch
• https://osv.dev/vulnerability/GHSA-399j-vxmf-hjvr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-11953 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-01467 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-11953 · Security Note
• https://github.com/react-native-community/cli/issues/2733#issuecomment-3502424164 · Note
• https://github.com/react-native-community/cli/commit/a8293dc29425f56249753507bc24d87b698d46e1 · Note
• https://github.com/react-native-community/cli/pull/1615 · Note
• https://github.com/react-native-community/cli/commit/5a792169d9883e0b0fb1ddf1ea46778f21510d18 · Note
• https://github.com/react-native-community/cli/commit/9e1fa8cc633e5dcf32244ffa60a871880be56722 · Note
• https://github.com/react-native-community/cli · Note
• https://github.com/react-native-community/cli?tab=readme-ov-file#compatibility · Note
• https://github.com/react-native-community/cli/releases/tag/v20.0.0 · Note