CVE-2025-11953

high-risk
Published 2025-11-03

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.

Do I need to act?

!
11.5% chance of exploitation in next 30 days
EPSS score — higher than 88% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (5)

Affected Vendors

React-Native-Community

References (6)

Patch https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f688...
Exploit https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulner...
Third Party Advisory https://x.com/SzymonRybczak/status/1986199665000566848
Third Party Advisory https://x.com/thymikee/status/1986770875954475375
US Government Resource https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-...
Exploit https://www.vulncheck.com/blog/metro4shell_eitw
62
/ 100
high-risk
Severity 32/34 · Critical
Exploitability 18/34 · Moderate
Exposure 12/34 · Low