Critical severity · published Nov 3, 2025
CVE-2025-11953
Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests
In wildKEV
9.8
CVSS
94%
EPSS
Yes
On KEV
Description
The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)94.0% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Feb 5, 2026
Federal remediation dueFeb 26, 2026
Ransomware campaign useNot known
Affected products
Which versions
RN
React Native Community Cli · React-native-community
19.0.0 before 19.1.2; 18.0.0; 20.0.0; 20.0.0; 20.0.0 · source: NVD
CL
CLI · React Native Community
All versions, or not specified · source: KEV
In the news
VulnerabilityHigh
[CISA KEV] CVE-2025-11953: React Native Community CLI - React Native Community CLI OS Command Injection Vulnerability
React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments.
CLCLICVE-2025-11953
Feb 5, 2026·CISA KEV
Affected product
RN
React Native Community Cli
React-native-community
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-11953
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-11953
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
technical-description
https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability
patch
https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547