CVE-2025-11953

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary...

CVE-2025-11953 Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary...

CVE-2025-11953

The CVE-2025-11953 issue affects the React Native Community CLI Server API Node.js Package (versions 4.8.0 up to, but not including, 20.0.0). The Metro Development Server bound to external interfaces exposes an endpoint vulnerable to OS command injection, enabling unauthenticated network attacker...

React Native Community CLI 安全漏洞

React Native Community CLI is an open source command line tool for React Native Community. A security vulnerability exists in the React Native Community CLI, which stems from a default binding to an external interface and an OS command injection vulnerability in the endpoint, which could allow an...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: chisel, jitsucom-bulker, checksec, cert-manager, gostatsd, kube-vip-cloud-provider, incert, kube-rbac-proxy, licenseclassifier, mockery, prometheus-alertmanager, redka, mkcert, redpanda, speedtest-go, telegraf, wazero, k6, kwok, falcoctl, stakater-reloader,...

GHSA-FRHW-MQJ2-WXW2 vulnerabilities

Vulnerabilities for packages: jitsucom-bulker, gostatsd, mockery, prometheus-alertmanager, telegraf, stakater-reloader, harbor-registry, opensearch-k8s-operator, vitess, azure-workload-identity-webhook, contour, envoy-ratelimit, azurefile-csi, nuclei, kpt, argo-rollouts, skopeo, pombump, ini-file...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: chisel, jitsucom-bulker, checksec, cert-manager, gostatsd, kube-vip-cloud-provider, incert, kube-rbac-proxy, licenseclassifier, mockery, prometheus-alertmanager, redka, mkcert, redpanda, speedtest-go, telegraf, wazero, k6, kwok, falcoctl, stakater-reloader,...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: chisel, jitsucom-bulker, checksec, cert-manager, gostatsd, kube-vip-cloud-provider, incert, kube-rbac-proxy, licenseclassifier, mockery, prometheus-alertmanager, redka, mkcert, redpanda, speedtest-go, telegraf, wazero, k6, kwok, falcoctl, stakater-reloader,...

GHSA-JWMF-CHVC-RF92 vulnerabilities

Vulnerabilities for packages: chisel, jitsucom-bulker, checksec, cert-manager, gostatsd, kube-vip-cloud-provider, incert, kube-rbac-proxy, licenseclassifier, mockery, prometheus-alertmanager, redka, mkcert, redpanda, speedtest-go, telegraf, wazero, k6, kwok, falcoctl, stakater-reloader,...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: chisel, jitsucom-bulker, checksec, cert-manager, gostatsd, kube-vip-cloud-provider, incert, kube-rbac-proxy, licenseclassifier, mockery, prometheus-alertmanager, redka, mkcert, redpanda, speedtest-go, telegraf, wazero, k6, kwok, falcoctl, stakater-reloader,...

CVE-2025-47912 vulnerabilities

Vulnerabilities for packages: chisel, jitsucom-bulker, checksec, cert-manager, gostatsd, kube-vip-cloud-provider, incert, kube-rbac-proxy, licenseclassifier, mockery, prometheus-alertmanager, redka, mkcert, redpanda, speedtest-go, telegraf, wazero, k6, kwok, falcoctl, stakater-reloader,...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: chisel, jitsucom-bulker, checksec, cert-manager, gostatsd, kube-vip-cloud-provider, incert, kube-rbac-proxy, licenseclassifier, mockery, prometheus-alertmanager, redka, mkcert, redpanda, speedtest-go, telegraf, wazero, k6, kwok, falcoctl, stakater-reloader,...

GHSA-HJX7-FPXX-MJ48 vulnerabilities

Vulnerabilities for packages: chisel, jitsucom-bulker, checksec, cert-manager, gostatsd, kube-vip-cloud-provider, incert, kube-rbac-proxy, licenseclassifier, mockery, prometheus-alertmanager, redka, mkcert, redpanda, speedtest-go, telegraf, wazero, k6, kwok, falcoctl, stakater-reloader,...

GHSA-WCW9-47FP-RRFR vulnerabilities

Vulnerabilities for packages: chisel, jitsucom-bulker, checksec, cert-manager, gostatsd, kube-vip-cloud-provider, incert, kube-rbac-proxy, licenseclassifier, mockery, prometheus-alertmanager, redka, mkcert, redpanda, speedtest-go, telegraf, wazero, k6, kwok, falcoctl, stakater-reloader,...

CVE-2025-58186 vulnerabilities

Vulnerabilities for packages: chisel, jitsucom-bulker, checksec, cert-manager, gostatsd, kube-vip-cloud-provider, incert, kube-rbac-proxy, licenseclassifier, mockery, prometheus-alertmanager, redka, mkcert, redpanda, speedtest-go, telegraf, wazero, k6, kwok, falcoctl, stakater-reloader,...

CVE-2025-58185 vulnerabilities

Vulnerabilities for packages: chisel, jitsucom-bulker, checksec, cert-manager, gostatsd, kube-vip-cloud-provider, incert, kube-rbac-proxy, licenseclassifier, mockery, prometheus-alertmanager, redka, mkcert, redpanda, speedtest-go, telegraf, wazero, k6, kwok, falcoctl, stakater-reloader,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: chisel, jitsucom-bulker, checksec, cert-manager, gostatsd, kube-vip-cloud-provider, incert, kube-rbac-proxy, licenseclassifier, mockery, prometheus-alertmanager, redka, mkcert, redpanda, speedtest-go, telegraf, k6, kwok, falcoctl, stakater-reloader, helm-set-status,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: chisel, jitsucom-bulker, checksec, cert-manager, gostatsd, kube-vip-cloud-provider, incert, kube-rbac-proxy, licenseclassifier, mockery, prometheus-alertmanager, redka, redpanda, speedtest-go, telegraf, wazero, k6, kwok, falcoctl, stakater-reloader, helm-set-status,...

CVE-2025-61724 vulnerabilities

Vulnerabilities for packages: kapp, influxd, restic-fips, fulcio, http-echo, kube-bench, custom-pod-autoscaler-fips, docker-machine-driver-harvester, terraform-provider-azuread, google-osconfig-agent, kube-state-metrics, kapp-controller-fips, fq, pvc-autoresizer, metacontroller,...

CVE-2025-58189 vulnerabilities

Vulnerabilities for packages: kapp, influxd, restic-fips, fulcio, http-echo, kube-bench, custom-pod-autoscaler-fips, docker-machine-driver-harvester, terraform-provider-azuread, google-osconfig-agent, kube-state-metrics, kapp-controller-fips, fq, pvc-autoresizer, metacontroller,...