{"id":"CVE-2025-11953","kind":"vulnerability","aliases":["CVE-2025-11953"],"related":[],"title":"react-native-community react native community cli: The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default","description":"React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"The React Native Community CLI's Metro Development Server exposes an endpoint that lets unauthenticated network attackers send POST requests and run arbitrary executables on the machine. On Windows, attackers can also run shell commands with fully controlled arguments, and CISA lists it as actively exploited.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-02-05T00:00:00+00:00","products":[{"name":"React Native Community CLI","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"react-native-community react native community cli","fixed":["19.1.2"],"affected":">= 19.0.0, < 19.1.2","ecosystem":"vendor"},{"name":"react-native-community react native community cli","fixed":[],"affected":"= 18.0.0","ecosystem":"vendor"},{"name":"react-native-community react native community cli","fixed":[],"affected":"= 20.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["developer-machines","exploited","metro","package","react-native","windows"],"not_affected_if":["firewalled-dev-server","not-running-metro-dev-server","production-builds-only"],"how_to_check":"Check whether the Metro dev server (default port 8081) is reachable from other machines on the network or the internet, for example with: netstat -an | findstr 8081 on Windows, or lsof -iTCP:8081 -sTCP:LISTEN on macOS/Linux.\nCheck the installed package version: npm ls @react-native-community/cli","fix":"Upgrade @react-native-community/cli to a fixed version (the fixed version is not stated in the sources; check the vendor advisory). Do not expose the Metro dev server to untrusted networks until upgraded.\nIf mitigations are unavailable, discontinue use of the product, per CISA guidance.","status":"open","published_at":"2025-11-03T17:15:32+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:42:25+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T20:42:25Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade @react-native-community/cli to a fixed version (the fixed version is not stated in the sources; check the vendor advisory). Do not expose the Metro dev server to untrusted networks until upgraded.\nIf mitigations are unavailable, discontinue use of the product, per CISA guidance.","reach":"network","summary":"The React Native Community CLI's Metro Development Server exposes an endpoint that lets unauthenticated network attackers send POST requests and run arbitrary executables on the machine. On Windows, attackers can also run shell commands with fully controlled arguments, and CISA lists it as actively exploited.","category":"package","who_cares":["react-native","metro","windows","developer-machines"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker runs arbitrary executables on the developer's machine over the network.","analyst_note":"Find the fixed version and the vendor advisory from the CISA KEV entry and the React Native CLI GitHub security advisory for CVE-2025-11953, plus the affected version range.","how_to_check":"Check whether the Metro dev server (default port 8081) is reachable from other machines on the network or the internet, for example with: netstat -an | findstr 8081 on Windows, or lsof -iTCP:8081 -sTCP:LISTEN on macOS/Linux.\nCheck the installed package version: npm ls @react-native-community/cli\nunknown","needs_analyst":true,"not_affected_if":["production-builds-only","not-running-metro-dev-server","firewalled-dev-server"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000547,"input_tokens":2584,"output_tokens":578,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':180C '-11953':30A,33A '-2025':29A,32A '22':179C 'action':170C 'activ':116B 'allow':130C 'also':103B,159C 'appli':171C 'applic':177C 'arbitrari':94B,145C,161C 'argument':110B,167C 'attack':88B,101B,133C,157C 'bind':22A 'bod':178C 'cisa':112B,168C 'cli':8A,21A,37A,45A,53A,61A,76B,121C 'cloud':183C 'command':106B,125C,163C 'communiti':4A,7A,20A,75B,120C 'community':36A,41A,44A,49A,52A,57A,60A 'contain':122C 'control':109B,166C 'could':129C 'cve':28A,31A 'default':27A 'develop':11A,63B,79B,141C 'developer-machin':62B 'discontinu':186C 'endpoint':83B,150C 'execut':95B,146C,160C 'exploit':65B,117B 'expos':81B,151C 'extern':24A 'follow':176C 'fulli':108B,165C 'guidanc':181C 'inject':126C 'instruct':175C 'interfac':25A 'let':85B 'list':113B 'machin':64B,98B 'metro':10A,66B,78B,140C 'mitig':172C,192C 'nativ':3A,6A,19A,70B,74B,119C 'native':35A,40A,43A,48A,51A,56A,59A 'network':87B,132C 'open':15A 'os':124C 'packag':67B 'per':173C 'post':90B,136C 'product':190C 'react':2A,5A,18A,34A,39A,42A,47A,50A,55A,58A,69B,73B,118C 'react-nat':68B 'react-native-commun':1A 'react-native-community':38A,46A,54A 'request':91B,137C 'requir':169C 'run':93B,104B,144C 'send':89B,135C 'server':12A,80B,142C,154C 'servic':184C 'shell':105B,162C 'unauthent':86B,131C 'unavail':194C 'use':187C 'vendor':174C 'via':147C 'vulner':127C,149C 'window':71B,100B,156C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-11-03T17:15:32+00:00","kev":{"dateAdded":"2026-02-05","dueDate":"2026-02-26","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"reefs@jfrog.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-11953","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-11953","severity":null,"published_at":"2026-02-05T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:21+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-11953","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11953","severity":null,"published_at":"2025-11-03T17:15:32+00:00","modified_at":"2026-06-17T08:31:28+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}