Skip to main content
IMMUNITYSEC

CVE-2025-11953

Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests

9.8
CRITICAL
CVSS 3.1
EPSS 94.0% · 100th pctCISA KEV · Exploited in the wildCWE-78
2025-11-03Updated 2026-02-26KEV 2026-02-05
CISA Known Exploited Vulnerabilities

React Native Community CLI OS Command Injection Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV
2026-02-05
Remediation due
2026-02-26

Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA notes
This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547 ; https://github.com/react-native-community/cli/pull/2735 ; https://nvd.nist.gov/vuln/detail/CVE-2025-11953

Description

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.

Severity

CVSS 3.1 · CNA9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC · CISA-ADP
Exploitationactive
Automatableyes
Technical impacttotal

Exploitation Context

as of October 13, 2026
All KEV statistics→
  • CISA added CVE-2025-11953 to the KEV catalog 94 days after its CVE record was published. The median for entries added in 2026 so far is 15 days.
  • Its current EPSS score (94.0%) is higher than that of 77% of CISA KEV entries.

Affected Products

ProductAffected versions
-
4.8.0 to <20.0.0

References

4 Links

Record Details

Published
2025-11-03
Last updated
2026-02-26
Assigner (CNA)
JFROG
Credited to
-

Related

Tool categories

Application Security ToolsPenetration Testing Tools

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.