The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.

The version of the React Native Community CLI Server API Node.js Package installed on the remote host is 4.8.0 prior to 20.0.0. It is, therefore, affected by a remote code execution vulnerability:

  - The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by     default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated     network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can     also execute arbitrary shell commands with fully controlled arguments. (CVE-2025-11953)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The Metro Development Server, which is opened by the React Native Community CLI, binds to external
    interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This
    allows unauthenticated network attackers to send a POST request to the server and run arbitrary
    executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled
    arguments. (CVE-2025-11953)

ID	Name	Product	Family	Severity
298225	React Native Community CLI Server API Node.js Package 4.8.0 < 20.0.0 Remote Code Execution (CVE-2025-11953)	Nessus	Misc.	critical
435983	SCA: security update for @react-native-community/cli, @react-native-community/cli-server-api (GHSA-399j-vxmf-hjvr)	Tenable Cloud Security	SCA Checks	critical
435983	SCA: security update for @react-native-community/cli, @react-native-community/cli-server-api (GHSA-399j-vxmf-hjvr)	Tenable Self-Hosted Container Security	SCA Checks	critical

Detections

Analytics

CVE-2025-11953

critical

Tenable Plugins

critical

critical

critical