cve-2025-11953-vulnerability-demo

React Native CLI コマンドインジェクションデモ CVE-2025-11953 ⚠️ 脆弱性デモ ⚠️ JFSA-2025-001495618 - React Native CLI における重大なコマンドインジェクション CVE : CVE-2025-11953 CVSS スコア : 9.8 Critical 影響を受けるパッケージ : @react-native-community/cli-server-api 影響を受けるバージョン : 4.8.0, 20.0.0 発見者 : JFrog Security Research Team 脆弱性の概要 React Native...

CVE-2025-11953-PoC

説明 React Native Community CLIによって起動されるMetro Development Serverは、デフォルトで外部インターフェースにバインドします。サーバーはOSコマンドインジェクションに対して脆弱なエンドポイントを公開しています。これにより、認証されていないネットワーク攻撃者がサーバーにPOSTリクエストを送信し、任意の実行ファイルを実行できます。Windowsでは、攻撃者は完全に制御された引数で任意のシェルコマンドを実行することもできます。 影響を受けるバージョン プロダクト| 深刻度| 影響を受けるバージョン| パッチ適用バージョン...

CVE-2025-11953-POC-

CVE-2025-11953 - React Native CLI RCE 研究環境 📋 概要 CVE-2025-11953 は、JFrog Security によって発見された React Native CLI の Metro 開発サーバーにおける重大なリモートコード実行 RCE 脆弱性です。この研究環境は、防御的なセキュリティ研究、検出開発、緩和テストのための実際の脆弱な実装を提供します。 CVSS スコア: 9.8 CRITICAL 影響を受けるバージョン: @react-native-community/cli-server-api v4.8.0 – v20.0.0-alpha....

React Native Community CLI - Unauthenticated OS Command Injection

The Metro development server started by the React Native Community CLI binds to external network interfaces by default and exposes an unauthenticated /open-url endpoint. Affected versions pass the attacker supplied url value straight to the open helper without validating the scheme, allowing an...

Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.22.2 security, enhancement & bug fix update

Red Hat OpenShift Data Foundation 4.22.2 security, enhancement & bug fix update Red Hat OpenShift Data Foundation 4.22.2 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-9558: MDR: Post-upgrade 4.21 to 4.22 DRPolicy validation failure in Metro DR DFBUGS-9404: Backport to...

Malicious code in jscrambler-metro-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6330e46f350d87abb62ebe25db40ffb14d8736a91e6b95f77f8cc6df053fbdc5 [email protected] is a Metro bundler plugin published under the Jscrambler vendor namespace. No a static rule matches and no traced...

MAL-2026-10674 Malicious code in jscrambler-metro-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6330e46f350d87abb62ebe25db40ffb14d8736a91e6b95f77f8cc6df053fbdc5 [email protected] is a Metro bundler plugin published under the Jscrambler vendor namespace. No a static rule matches and no traced...

CVE-2024-37496

Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Metro Magazine: from n/a through 1.3.7...

CVE-2024-37496

CVE-2024-37496 concerns the WordPress Metro Magazine theme (

CVE-2026-40809

Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Metro Magazine: from n/a through 1.4.1...

EUVD-2026-37058

Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Metro Magazine: from n/a through 1.4.1...

CVE-2026-40809 WordPress Metro Magazine theme <= 1.4.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Metro Magazine: from n/a through 1.4.1...

CVE-2026-40809

CVE-2026-40809 concerns the WordPress Metro Magazine theme (versions

WordPress Metro Magazine theme <= 1.4.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Theme Metro Magazine versions = 1.4.1...

Malicious code in metro-evaluator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2e35441f182ca0b66905b74b51c0db61c1d641d7ecc920cdfef2ddedff38dda The package metro-evaluator was found to contain malicious code...

MAL-2026-1792 Malicious code in metro-evaluator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2e35441f182ca0b66905b74b51c0db61c1d641d7ecc920cdfef2ddedff38dda The package metro-evaluator was found to contain malicious code...

CVE-2026-27383

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in RadiusTheme Metro metro allows PHP Local File Inclusion.This issue affects Metro: from n/a through = 2.13...

CVE-2026-27382

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in RadiusTheme Metro metro allows DOM-Based XSS.This issue affects Metro: from n/a through = 2.13...

EUVD-2026-9635

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in RadiusTheme Metro metro allows DOM-Based XSS.This issue affects Metro: from n/a through = 2.13...

EUVD-2026-9636

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in RadiusTheme Metro metro allows PHP Local File Inclusion.This issue affects Metro: from n/a through = 2.13...