ZeroDay Findings
Sign inSign up

Findings

CVE-2025-11953

React Native Community CLI OS Command Injection Vulnerability

Published Nov 3, 2025 · updated Jun 17, 2026 · React Native Community CLI

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.

Timeline

Detection, updates, and resolution for this record.

  1. Nov 3, 2025 · Catalog

    Detected

    The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled

  2. Feb 5, 2026 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  3. Feb 26, 2026 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  4. Jun 17, 2026 · Catalog

    Updated

    The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA due date Feb 26, 2026

Affected

  • cpe react-native-community/react native community cliversion unspecified
  • cpe react-native-community/react native community cli18.0.0
  • cpe react-native-community/react native community cli20.0.0
  • vendor React Native Community CLIversion unspecified

Sources

  • CISA KEVCVE-2025-11953

    React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments.

    cisa.gov
  • CVE.orgCVE-2025-11953

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2025-11953

    30-day exploitation probability 94.0%

    first.org
  • NIST NVDCVE-2025-11953

    The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server

    nvd.nist.gov

References