- CVE-2025-11953 allows OS command injection via Metro server in React Native CLI
- Affects versions 4.8.0–20.0.0-alpha.2; patched in 20.0.0; exploit requires no authentication
- No confirmed exploitation yet; restrict server exposure or update immediately
A widely popular npm package carried a critical severity vulnerability that allowed threat actors to, in certain scenarios, run malicious commands, experts have warned.
Cybersecurity researchers from JFrog say the package in question is called “@react-native-community/cli”, made to help developers build React Native mobile applications, and getting up to two million downloads a week.
On NVD, it is explained the Metro Development Server, opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint vulnerable to OS command injection, allowing threat actors to send a POST request and run arbitrary executables - meaning on Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments, and on Linux and macOS, on the other hand, it can execute arbitrary binaries with limited parameter control.
Acting like hacktivists
The bug is tracked as CVE-2025-11953, and has a severity score of 9.8/10 (critical). It affects package versions 4.8.0 through 20.0.0-alpha.2, and has been patched in version 20.0.0 released early last month. Those that cannot immediately update their endpoints should restrict network exposure of the Metro server.
If you are using React Native with a framework that doesn’t rely on Metro as a development server, you are not affected, it was further stated. "This zero day vulnerability is particularly dangerous due to its ease of exploitation, lack of authentication requirements and broad attack surface," JFrog’s researchers explained. "It also exposes the critical risks hidden in third-party code."
"For developer and security teams, this underscores the need for automated, comprehensive security scanning across the software supply chain to ensure easily exploitable flaws are remediated before they impact your organization."
At press time, there were no confirmed public reports that CVE‑2025‑11953 had been exploited in the wild. Multiple sources indicate that while the vulnerability is highly exploitable, actual exploit activity hasn’t yet been verified.
Via The Hacker News
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!
And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.
