Baddies are exploiting a critical bug in React Native's Metro development server to deliver malware to both Windows and Linux machines, and yet the in-the-wild attacks still haven't received the "broad public acknowledgement" that they should, according to security researchers. The vulnerability affects the React Native Community command line tool, a very popular npm package with nearly 2.5 million weekly downloads. React Native is a development tool created by Meta that allows users to build mobile applications for iOS and Android using JavaScript and React. The flaw, tracked as CVE-2025-11953, arises because the Metro development server started by the React Native Community command line tool exposes an endpoint vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run malicious executables. Similarly, on Windows machines, miscreants can abuse the security hole to execute arbitrary shell commands with fully controlled arguments. JFrog researchers discovered the vulnerability and disclosed it in early November after Meta issued a fix. The research team assigned it a critical, 9.8 CVSS severity rating, meaning it's almost as bad as bugs get. Bug hunters wasted no time publishing proof-of-concept exploits on GitHub, with one such POC being published the same day as the public bug disclosure. "VulnCheck observed exploitation attempts as early as December, well before public discussion framed CVE-2025-11953 as a...
Critical React Native Metro dev server bug under attack as researchers scream into the void
The Register
·Jessica Lyons
·Published Feb 3, 2026
·Updated
Affected Software
1 affected component
Meta React Native Community<=latest
Frequently Asked Questions
1
What is the main topic of this article?
The article discusses a critical vulnerability in the React Native Metro development server being exploited by attackers to deliver malware.
2
What security implications are discussed?
The article highlights significant security risks as the Metro development server's vulnerability allows malware delivery to Windows and Linux systems.
3
What products or software are affected?
The affected software is the Meta React Native Community's Metro development server.
4
What are the current attack methods mentioned in the article?
Attackers are using the vulnerability to deliver malware during development processes on affected machines.
5
Why do researchers feel the issue hasn’t received enough public attention?
Researchers believe the ongoing exploitation of the vulnerability has not been widely acknowledged or acted upon in the security community.