Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests
Affects @react-native-community/cli and cli-server-api in the Metro development server setup from 4.8.0 up to 20.0.0-alpha.2, with fixes in 18.0.1, 19.1.2 and 20.0.0. No vendor rating is given, so CVSS 9.8 (critical) is the only rating.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 20.0.0, 19.1.2, 18.0.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The React Native Community CLI's Metro Development Server, which is commonly run during app development, is affected. An unauthenticated attacker on the network can exploit an exposed endpoint to run arbitrary programs and commands on the developer's machine, with full control over arguments on Windows.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- @react-native-community/cli-server-api
From 4.8.0 · fixed in 20.0.0
- @react-native-community/clinpm
From 20.0.0-alpha.0 · fixed in 20.0.0
- @react-native-community/clinpm
From 19.0.0-alpha.0 · fixed in 19.1.2
- @react-native-community/clinpm
From 18.0.0 · fixed in 18.0.1
- @react-native-community/cli-server-apinpm
From 20.0.0-alpha.0 · fixed in 20.0.0
- @react-native-community/cli-server-apinpm
From 19.0.0-alpha.0 · fixed in 19.1.2
- @react-native-community/cli-server-apinpm
From 18.0.0 · fixed in 18.0.1
References 2
GitHub · react-native-community/cli
Questions about CVE-2025-11953
What does this mean?
Unauthenticated remote attackers can send HTTP requests to the Metro development server and run arbitrary OS commands or executables on the machine running it. The flaw is a command injection in React Native Community CLI.Source: jfrog.com
Am I affected, and how do I check?
The affected packages are @react-native-community/cli and @react-native-community/cli-server-api in the ranges listed for 4.8.0 to before 20.0.0, 18.0.0 to before 18.0.1, 19.0.0-alpha.0 to before 19.1.2, and 20.0.0-alpha.0 to before 20.0.0. The exposed setup is running the Metro dev server with npm start or npx react-native start. To check a project, look up the installed versions of these packages in its package.json or with npm ls @react-native-community/cli.Source: jfrog.com
What should I do about it?
Upgrade @react-native-community/cli to 20.0.0, or to 19.1.2 or 18.0.1 if staying on those release lines. Upgrade @react-native-community/cli-server-api to 20.0.0, or to 19.1.2 or 18.0.1 on the same lines.Source: jfrog.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-02-05, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data