---
id: "CVE-2025-11953"
kind: "vulnerability"
aliases: ["CVE-2025-11953"]
title: "react-native-community react native community cli: The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "package"
products: [{"name": "React Native Community CLI", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "react-native-community react native community cli", "fixed": ["19.1.2"], "affected": ">= 19.0.0, < 19.1.2", "ecosystem": "vendor"}, {"name": "react-native-community react native community cli", "fixed": [], "affected": "= 18.0.0", "ecosystem": "vendor"}, {"name": "react-native-community react native community cli", "fixed": [], "affected": "= 20.0.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["developer-machines", "exploited", "metro", "package", "react-native", "windows"]
not_affected_if: ["firewalled-dev-server", "not-running-metro-dev-server", "production-builds-only"]
published_at: "2025-11-03T17:15:32+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T23:44:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-11953", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11953", "first_seen_at": "2026-10-23T23:44:51+00:00"}]
---

# react-native-community react native community cli: The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default

The React Native Community CLI's Metro Development Server exposes an endpoint that lets unauthenticated network attackers send POST requests and run arbitrary executables on the machine. On Windows, attackers can also run shell commands with fully controlled arguments, and CISA lists it as actively exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:React Native Community CLI affected ? fixed ?
- vendor:react-native-community react native community cli affected >= 19.0.0, < 19.1.2 fixed 19.1.2
- vendor:react-native-community react native community cli affected = 18.0.0 fixed ?
- vendor:react-native-community react native community cli affected = 20.0.0 fixed ?

## How to check

Check whether the Metro dev server (default port 8081) is reachable from other machines on the network or the internet, for example with: netstat -an | findstr 8081 on Windows, or lsof -iTCP:8081 -sTCP:LISTEN on macOS/Linux.
Check the installed package version: npm ls @react-native-community/cli

## Fix

Upgrade @react-native-community/cli to a fixed version (the fixed version is not stated in the sources; check the vendor advisory). Do not expose the Metro dev server to untrusted networks until upgraded.
If mitigations are unavailable, discontinue use of the product, per CISA guidance.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-11953
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-11953

## From the sources

React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_