Vulnerability details

CVE-2025-11953

Actively exploited

React Native Community CLI

Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests

CVSS 3.1

9.8Critical

Remedy

Required action (CISA): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. (due: 2026-02-26)

Official description

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.

CVSS scores

Score	Version	Source	Vector
9.8Critical	3.1	CVEProject cvelistV5 (CNA) (JFROG)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
No product information recorded.

References and advisories

https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability technical-description
https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547 patch
https://www.vulncheck.com/blog/metro4shell_eitw third-party-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11953 government-resource
https://x.com/SzymonRybczak/status/1986199665000566848
https://x.com/thymikee/status/1986770875954475375

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-11-03
Last updated: 2026-02-26
State: Published
Assigner (CNA): JFROG
Kolun priority: 80 · High

CISA KEV catalog

Date added: 2026-02-05
Due date: 2026-02-26
Used in ransomware: Unknown

Exploit prediction (EPSS)

93.98%

Probability of exploitation in 30 days

99.8%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: Active
Technical impact: Total

Weaknesses (CWE)

CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')