cve-2025-11953-vulnerability-demo

React Native CLI 命令注入演示 CVE-2025-11953 ⚠️ 漏洞演示 ⚠️ JFSA-2025-001495618 - React Native CLI 中的严重命令注入 CVE : CVE-2025-11953 CVSS 评分 : 9.8 严重 受影响软件包 : @react-native-community/cli-server-api 受影响版本 : 4.8.0, 20.0.0 发现者 : JFrog 安全研究团队 漏洞概述 由 React Native CLI 打开的 Metro 开发服务器，默认绑定到外部接口。该服务器暴露了一个端点...

hermes-decomp

用于 Hermes 字节码 （.hbc）的 Rust 反编译器，Hermes 是 React Native 背后的 JS 引擎。支持 HBC 40 至 99 。 安装 从 Releases 或 Actions 获取预编译二进制文件 （Linux / macOS / Windows）： 资源后缀| 平台 ---|--- linux-x8664 / linux-arm64| Linux macos-arm64 / macos-x8664| macOS windows-x8664| Windows 压缩包中包含 hermes-decomp 和 hermes-mcp。校验：shasum -a 2...

mhf

移动端辅助框架 是一个自动化识别移动应用程序所用框架/技术的工具。此外，它有助于查找敏感信息或为使用识别的平台提供建议。 工作原理？ 该工具搜索与移动应用开发中使用的技术相关的文件，例如配置文件、资源文件和源代码文件。 示例 Cordova 搜索文件： root@kitploit: index.html cordova.js cordovaplugins.js React Native Android & iOS 搜索文件 root@kitploit: Android 文件： libreactnativejni.so index.android.bundle iOS 文件：...

CVE-2025-11953-PoC

描述 Metro 开发服务器由 React Native Community CLI 启动，默认绑定到外部接口。该服务器暴露了一个存在操作系统命令注入漏洞的端点，这使得未经身份验证的网络攻击者可以向服务器发送 POST 请求并运行任意可执行文件。在 Windows 上，攻击者还可以使用完全受控的参数执行任意 shell 命令。 受影响版本 产品| 严重性| 受影响版本| 修复版本 ---|---|---|--- @react-native-community/cli| 严重 9.8| 4.8.0 - 20.0.0‑alpha.2| 20.0.0 用法 1. 安装依赖...

CVE-2025-11953-POC-

CVE-2025-11953 - Entorno de Investigación de RCE en React Native CLI 📋 Resumen CVE-2025-11953 es una vulnerabilidad crítica de Ejecución Remota de Código RCE en el servidor de desarrollo Metro del CLI de React Native, descubierta por JFrog Security. Este entorno de investigación proporciona la...

CyberPup

CyberPup 一款免费、开源的网络安全应用，专为普通大众设计。 CyberPup 通过引导式清单、简短课程和泄露检查等工具，帮助非技术用户保障数字生活安全。所有指导均基于 ACSC、CISA 和 NIST 的知名框架，并将其转化为任何人都能实际遵循的通俗语言。 多数个人网络安全工具要么过于技术化，要么只解决单一方面的问题，要么就是彻头彻尾的骗局。CyberPup 试图引导用户全面了解密码、电子邮件安全、设备卫生、社交媒体和泄露检查。 该应用已在 iOS App Store 上线，约有 500...

reproducer-okio-cve-2023-3635

reproducer-okio-cve-2023-3635 此项目复现的内容 针对 facebook/react-native58148 的复现器： React Native 自带的 packages/react-native/gradle/libs.versions.toml 将 okhttp = "4.9.2" / okio = "2.9.0" 固定为指定版本，而 okio 2.9.0 受 CVE-2023-3635 / GHSA-w33c-445m-f8w7 影响， 该漏洞已在 okio 3.4.0 中修复。 未对任何应用代码进行修改以生成此项目。 ReproducerApp 是...

CVE-2024-25466

CVE-2024-25466 Descripción para CVE-2024-25466 Descripción sugerida La vulnerabilidad de Directory Traversal en React Native Document Picker anterior a v.9.1.1 y corregida en v.9.1.1 permite a un atacante local ejecutar código arbitrario mediante un script manipulado en el componente de la librer...

CVE-2026-84685

The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering SSR environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory...

CVE-2026-84685 Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management

The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering SSR environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory...

CVE-2026-84685

The react-native-auth0 SDK 's web platform implementation fails to scope its in-memory token cache to individual user sessions in server-side rendering (SSR) environments where module state persists across HTTP requests. As a result, tokens cached in module memory can be retrieved by subsequent r...

MAL-2026-16042 Malicious code in krdpass-auth-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a74ab9e45d4f67b40e21dc7491aff1979b4bf79be24bc49b8588916c18b847f package.json declares a preinstall script preinstall.js that runs automatically on npm install. The script collects os.hostname, os.userInfo, homedir...

Malicious code in krdpass-auth-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a74ab9e45d4f67b40e21dc7491aff1979b4bf79be24bc49b8588916c18b847f package.json declares a preinstall script preinstall.js that runs automatically on npm install. The script collects os.hostname, os.userInfo, homedir...

React Native Community CLI - Unauthenticated OS Command Injection

The Metro development server started by the React Native Community CLI binds to external network interfaces by default and exposes an unauthenticated /open-url endpoint. Affected versions pass the attacker supplied url value straight to the open helper without validating the scheme, allowing an...

Malicious code in amplitude-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 489592652dd724254e29c10536019e0e03e8032e781748a73fc357bb40f50a1d package.json declares a single dependency whose source is a bare HTTPS URL https://repo.securityctrl.com/amplitude-react-native rather than a registr...

MAL-2026-15525 Malicious code in amplitude-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 489592652dd724254e29c10536019e0e03e8032e781748a73fc357bb40f50a1d package.json declares a single dependency whose source is a bare HTTPS URL https://repo.securityctrl.com/amplitude-react-native rather than a registr...

MAL-2026-13495 Malicious code in blekit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce64fb8d6264bfc9affaf6b3544637cb8559b232075b70a48144e5f1c1743020 blekit is published as a React Native BLE SDK, but its main entry re-exports a logger module consoleApp/initializeLogger/getCurrentStatus from...

Malicious code in react-native-ui-message (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 615dd38493e2ff2257cfe5fe94b089a9001329b0d68c6b48f7ac491e4fcb205f [email protected] declares a postinstall hook that runs src/utilities/SubscriptionGuard.js. On install the script enumerates non-internal...

Malicious code in @qlik/react-native-simple-grid (npm)

npm/@qlik/react-native-simple-grid is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11769 Malicious code in @ornikar/react-native-svg-transformer (npm)

npm/@ornikar/react-native-svg-transformer is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojaniz...