CVE-2025-11953

critical

Description

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.

References

https://x.com/thymikee/status/1986770875954475375

https://x.com/SzymonRybczak/status/1986199665000566848

https://www.securityweek.com/critical-smartermail-vulnerability-exploited-in-ransomware-attacks/

https://securityaffairs.com/187675/security/u-s-cisa-adds-smartertools-smartermail-and-react-native-community-cli-flaws-to-its-known-exploited-vulnerabilities-catalog.html

https://www.cisa.gov/news-events/alerts/2026/02/05/cisa-adds-two-known-exploited-vulnerabilities-catalog

https://www.securityweek.com/critical-react-native-vulnerability-exploited-in-the-wild/

https://www.bleepingcomputer.com/news/security/hackers-use-critical-react-native-metro-bug-to-breach-dev-systems/

https://thehackernews.com/2026/02/hackers-exploit-metro4shell-rce-flaw-in.html

https://securityaffairs.com/187587/hacking/hackers-abused-react-native-cli-flaw-to-deploy-rust-malware-before-public-disclosure.html

https://hackread.com/react-native-flaw-exposes-developer-remote-attacks/

https://www.securityweek.com/critical-flaw-in-popular-react-native-npm-package-exposes-developers-to-attacks/

https://thehackernews.com/2025/11/critical-react-native-cli-flaw-exposed.html

https://github.com/Mr-In4inci3le/CVE-2025-11953-POC-

https://github.com/N3k0t-dev/PoC-CVE-collection

https://github.com/B1ack4sh/Blackash-CVE-2025-11953

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11953

https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability

https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547

Details

Source: Mitre, NVD

Published: 2025-11-03

Updated: 2026-02-06

Named Vulnerability: Metro4ShellKnown Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.9398