Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@react-native-community/cli

1 known vulnerability (1 critical), with the versions each affects and the releases that fix them.

Latest release
20.2.0 (Jun 25, 2026): no advisory affects it
Newest unaffected release
20.2.0 (Jun 25, 2026), the latest release
Advisories
1 · 1 critical
Weekly downloads
3.7M
Dependents
15
Releases
334 since 1.0.0 (Jan 17, 2019)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2025-11953
    Affects 18.0.0 (18.0.1 is outside it); 19.0.0-alpha.0 to 19.1.1 (19.1.2 is outside it); 20.0.0-alpha.0 to 20.0.0-alpha.2 (20.0.0 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 1

  • CVE-2025-11953Critical 9.8 · KEV

    Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests

    Affected: from 20.0.0-alpha.0, fixed in 20.0.0; from 19.0.0-alpha.0, fixed in 19.1.2; from 18.0.0, fixed in 18.0.1.

    Fixed in 18.0.1 (released Nov 5, 2025, 2 days after disclosure), 19.1.2 (released Nov 5, 2025, 2 days after disclosure) and 20.0.0 (released Aug 11, 2025, 84 days before disclosure).

    The latest release, 20.2.0, is not affected.

    3.5% of @react-native-community/cli downloads last week were affected versions (145.1K).