cve-2025-11953-vulnerability-demo

React Native CLI 命令注入演示 CVE-2025-11953 ⚠️ 漏洞演示 ⚠️ JFSA-2025-001495618 - React Native CLI 中的严重命令注入 CVE : CVE-2025-11953 CVSS 评分 : 9.8 严重 受影响软件包 : @react-native-community/cli-server-api 受影响版本 : 4.8.0, 20.0.0 发现者 : JFrog 安全研究团队 漏洞概述 由 React Native CLI 打开的 Metro 开发服务器，默认绑定到外部接口。该服务器暴露了一个端点...

CVE-2025-11953-POC-

CVE-2025-11953 - React Native CLI RCE 研究环境 📋 概述 CVE-2025-11953 是 React Native CLI 的 Metro 开发服务器中的一个严重远程代码执行（RCE）漏洞，由 JFrog 安全团队发现。本研究环境提供了实际的有漏洞实现，用于防御性安全研究、检测开发及缓解测试。 CVSS 评分: 9.8 严重 受影响版本: @react-native-community/cli-server-api v4.8.0 – v20.0.0-alpha.2 修复版本: v20.0.0+（2025年10月发布） 漏洞类型: 通过...

Hackers Exploit Metro4Shell RCE Flaw in React Native CLI npm Package

Threat actors have been observed exploiting a critical security flaw impacting the Metro Development Server in the popular "@react-native-community/cli" npm package. Cybersecurity company VulnChecksaid it first observed exploitation of CVE-2025-11953 aka Metro4Shell on December 21, 2025. With a...

Severe React Native Flaw Exposes Developer Systems to Remote Attacks

JFrog researchers found a critical RCE vulnerability CVE-2025-11953 in the popular React Native CLI. Developers using versions 4.8.0-20.0.0-alpha.2 must update to patch the flaw...

Exploit for CVE-2025-11953

React Native CLI Command Injection Demo CVE-2025-11953 ⚠...

Critical React Native CLI Flaw Exposed Millions of Developers to Remote Attacks

Details have emerged about a now-patched critical security flaw in the popular "@react-native-community/cli" npm package that could be potentially exploited to run malicious operating system OS commands under certain conditions. "The vulnerability allows remote unauthenticated attackers to easily...

CVE-2025-11953

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary...

CVE-2025-11953

The CVE-2025-11953 issue affects the React Native Community CLI Server API Node.js Package (versions 4.8.0 up to, but not including, 20.0.0). The Metro Development Server bound to external interfaces exposes an endpoint vulnerable to OS command injection, enabling unauthenticated network attacker...

CVE-2025-11953 Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary...

React Native Community CLI 安全漏洞

React Native Community CLI is an open source command line tool for React Native Community. A security vulnerability exists in the React Native Community CLI, which stems from a default binding to an external interface and an OS command injection vulnerability in the endpoint, which could allow an...

PT-2025-44787

Name of the Vulnerable Software and Affected Versions React Native Community CLI versions 4.8.0 through 20.0.0-alpha.2 Description The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint vulnerable to...