cve-2025-11953-vulnerability-demo

React Native CLI Command Injection Demo CVE-2025-11953 ⚠️ VULNERABILITY DEMONSTRATION ⚠️ JFSA-2025-001495618 - Critical Command Injection in React Native CLI CVE : CVE-2025-11953 CVSS Score : 9.8 Critical Affected Package : @react-native-community/cli-server-api Vulnerable Versions : 4.8.0, 20.0.0...

CVE-2025-11953-POC-

CVE-2025-11953 - React Native CLI RCE Research Environment 📋 Overview CVE-2025-11953 is a critical Remote Code Execution RCE vulnerability in the React Native CLI's Metro development server discovered by JFrog Security. This research environment provides the actual vulnerable implementation for...

React Native Community CLI - Unauthenticated OS Command Injection

The Metro development server started by the React Native Community CLI binds to external network interfaces by default and exposes an unauthenticated /open-url endpoint. Affected versions pass the attacker supplied url value straight to the open helper without validating the scheme, allowing an...

React Native Community CLI remote command execution

Added: 02/04/2026 Background React Native is a framework for building mobile JavaScript applications. React Native Community CLI is a collection of command line tools that help developers build React Native mobile applications. Problem A vulnerability in React Native Community CLI when running wi...

React Native Community CLI remote command execution

Added: 02/04/2026 Background React Native is a framework for building mobile JavaScript applications. React Native Community CLI is a collection of command line tools that help developers build React Native mobile applications. Problem A vulnerability in React Native Community CLI when running wi...

GHSA-399J-VXMF-HJVR @react-native-community/cli has arbitrary OS command injection

The Metro Development Server, which is opened by the React Native CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the url variable processing in openURLMiddleware.ts. An attacker can execute arbitrary system commands by sending crafted HTTP POST requests, if the Metro development server is in use. This server binds to all...