CVE-2025-11953: React Native Community CLI OS Command Injection Vulnerability
React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments.
Other sources
The Metro Development Server, which is opened by the React Native CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.
— GitHub
The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@react-native-community/cli-server-apito a version that resolves this vulnerability.Fixed in 18.0.1 - Upgrade
Upgrade
npm/@react-native-community/cli-server-apito a version that resolves this vulnerability.Fixed in 19.1.2 - Upgrade
Upgrade
npm/@react-native-community/cli-server-apito a version that resolves this vulnerability.Fixed in 20.0.0 - Upgrade
Upgrade
npm/@react-native-community/clito a version that resolves this vulnerability.Fixed in 18.0.1 - Upgrade
Upgrade
npm/@react-native-community/clito a version that resolves this vulnerability.Fixed in 19.1.2 - Upgrade
Upgrade
npm/@react-native-community/clito a version that resolves this vulnerability.Fixed in 20.0.0 - Remove
Remove
npm/@react-native-community/cli-server-apifrom your environment.Discontinue use/uninstall the product if mitigations are unavailable.
- Remove
Remove
npm/@react-native-community/clifrom your environment.Discontinue use/uninstall the product if mitigations are unavailable.
- Compensating control
Apply mitigations per vendor instructions and follow applicable BOD 22-01 guidance for cloud services. If immediate patching is not possible, restrict network access to the Metro Development Server (for example with firewall rules, ACLs, or network isolation) until a fixed version is deployed.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11953?
CVE-2025-11953 is classified as a critical vulnerability due to its potential for OS command injection.
How can I fix CVE-2025-11953?
To mitigate CVE-2025-11953, ensure that the Metro Development Server is configured to bind only to localhost and not expose endpoints to external interfaces.
Who is affected by CVE-2025-11953?
CVE-2025-11953 affects users of the Meta React Native CLI who run the Metro Development Server.
What type of attack does CVE-2025-11953 enable?
CVE-2025-11953 enables unauthenticated network attackers to perform OS command injection via crafted POST requests.
Does CVE-2025-11953 require authentication to exploit?
CVE-2025-11953 can be exploited without authentication, making it more dangerous for exposed servers.