Exploit for CVE-2025-11953

React Native CLI Command Injection Demo CVE-2025-11953 ⚠...

Critical React Native CLI Flaw Exposed Millions of Developers to Remote Attacks

Details have emerged about a now-patched critical security flaw in the popular "@react-native-community/cli" npm package that could be potentially exploited to run malicious operating system OS commands under certain conditions. "The vulnerability allows remote unauthenticated attackers to easily...

@react-native-community/cli (18.0.0) potentially affected by CVE-2025-11953 via @react-native-community/cli-server-api (18.0.0)

@react-native-community/cli-server-api NPM version 18.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @react-native-community/cli-server-api and may be impacted: - @react-native-community/cli 18.0.0 Source cves: CVE-2025-11953 Source advisory:...

@react-native-community/cli (18.0.0) potentially affected by CVE-2025-11953 via @react-native-community/cli-server-api (18.0.0)

@react-native-community/cli-server-api NPM version 18.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @react-native-community/cli-server-api and may be impacted: - @react-native-community/cli 18.0.0 Source cves: CVE-2025-11953 Source advisory:...

@react-native-community/cli (>=19.0.0-alpha.0, <=19.1.1) potentially affected by CVE-2025-11953 via @react-native-community/cli-server-api (>=19.0.0-alpha.0, <=19.1.1)

@react-native-community/cli-server-api NPM version =19.0.0-alpha.0, =19.0.0-alpha.0, =19.1.1 Source cves: CVE-2025-11953 Source advisory: OSV:GHSA-399J-VXMF-HJVR...

@react-native-community/cli (>=20.0.0-alpha.0, <=20.0.0-alpha.2) potentially affected by CVE-2025-11953 via @react-native-community/cli-server-api (>=20.0.0-alpha.0, <=20.0.0-alpha.2)

@react-native-community/cli-server-api NPM version =20.0.0-alpha.0, =20.0.0-alpha.0, =20.0.0-alpha.2 Source cves: CVE-2025-11953 Source advisory: GHSA-399J-VXMF-HJVR...

@react-native-community/cli (>=19.0.0-alpha.0, <=19.1.1) potentially affected by CVE-2025-11953 via @react-native-community/cli-server-api (>=19.0.0-alpha.0, <=19.1.1)

@react-native-community/cli-server-api NPM version =19.0.0-alpha.0, =19.0.0-alpha.0, =19.1.1 Source cves: CVE-2025-11953 Source advisory: GHSA-399J-VXMF-HJVR...

@react-native-community/cli (>=20.0.0-alpha.0, <=20.0.0-alpha.2) potentially affected by CVE-2025-11953 via @react-native-community/cli-server-api (>=20.0.0-alpha.0, <=20.0.0-alpha.2)

@react-native-community/cli-server-api NPM version =20.0.0-alpha.0, =20.0.0-alpha.0, =20.0.0-alpha.2 Source cves: CVE-2025-11953 Source advisory: OSV:GHSA-399J-VXMF-HJVR...

CVE-2025-11953

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary...

@react-native-community/cli (18.0.0) potentially affected by CVE-2025-11953 via @react-native-community/cli-server-api (18.0.0)

@react-native-community/cli-server-api NPM version 18.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @react-native-community/cli-server-api and may be impacted: - @react-native-community/cli 18.0.0 Source cves: CVE-2025-11953 Source advisory:...

@fluentui-react-native/tester (>=0.170.52, <=0.170.57), @fluentui-react-native/tester-win32-81 (>=0.38.69, <=0.38.70) +3 more potentially affected by CVE-2025-11953 via @react-native-community/cli-server-api (17.0.0)

@react-native-community/cli-server-api NPM version 17.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @react-native-community/cli-server-api and may be impacted: - @fluentui-react-native/tester =0.170.52, =0.38.69, =0.81.4, =0.81.5, =0.81.37 Source...

@react-native-community/cli (>=19.0.0-alpha.0, <=19.1.1) potentially affected by CVE-2025-11953 via @react-native-community/cli-server-api (>=19.0.0-alpha.0, <=19.1.1)

@react-native-community/cli-server-api NPM version =19.0.0-alpha.0, =19.0.0-alpha.0, =19.1.1 Source cves: CVE-2025-11953 Source advisory: SNYK:JS-REACTNATIVECOMMUNITYCLISERVERAPI-13836141...

@react-native-community/cli (>=20.0.0-alpha.0, <=20.0.0-alpha.2) potentially affected by CVE-2025-11953 via @react-native-community/cli-server-api (>=20.0.0-alpha.0, <=20.0.0-alpha.2)

@react-native-community/cli-server-api NPM version =20.0.0-alpha.0, =20.0.0-alpha.0, =20.0.0-alpha.2 Source cves: CVE-2025-11953 Source advisory: SNYK:JS-REACTNATIVECOMMUNITYCLISERVERAPI-13836141...

@react-native-community/cli (>=20.0.0-alpha.0, <=20.0.0-alpha.2) potentially affected by CVE-2025-11953 via @react-native-community/cli-server-api (>=20.0.0-alpha.0, <=20.0.0-alpha.2)

@react-native-community/cli-server-api NPM version =20.0.0-alpha.0, =20.0.0-alpha.0, =20.0.0-alpha.2 Source cves: CVE-2025-11953 Source advisory: MEND:CVE-2025-11953...

@react-native-community/cli (>=19.0.0-alpha.0, <=19.1.1) potentially affected by CVE-2025-11953 via @react-native-community/cli-server-api (>=19.0.0-alpha.0, <=19.1.1)

@react-native-community/cli-server-api NPM version =19.0.0-alpha.0, =19.0.0-alpha.0, =19.1.1 Source cves: CVE-2025-11953 Source advisory: MEND:CVE-2025-11953...

CVE-2025-11953

The CVE-2025-11953 issue affects the React Native Community CLI Server API Node.js Package (versions 4.8.0 up to, but not including, 20.0.0). The Metro Development Server bound to external interfaces exposes an endpoint vulnerable to OS command injection, enabling unauthenticated network attacker...

@react-native-community/cli (18.0.0) potentially affected by CVE-2025-11953 via @react-native-community/cli-server-api (18.0.0)

@react-native-community/cli-server-api NPM version 18.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @react-native-community/cli-server-api and may be impacted: - @react-native-community/cli 18.0.0 Source cves: CVE-2025-11953 Source advisory:...

CVE-2025-11953 Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary...

React Native Community CLI security vulnerability

React Native Community CLI is an open source command line tool for React Native Community. A security vulnerability exists in the React Native Community CLI, which stems from a default binding to an external interface and an OS command injection vulnerability in the endpoint, which could allow an...

CVE-2025-11953: Improper Neutralization of Special Elements used in an OS Command

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary...