1078 matches found
cve-2025-11953-vulnerability-demo
React Native CLI Command Injection Demo CVE-2025-11953 ⚠️ VULNERABILITY DEMONSTRATION ⚠️ JFSA-2025-001495618 - Critical Command Injection in React Native CLI CVE : CVE-2025-11953 CVSS Score : 9.8 Critical Affected Package : @react-native-community/cli-server-api Vulnerable Versions : 4.8.0, 20.0.0...
hermes-decomp
Rust decompiler for Hermes bytecode .hbc, the JS engine behind React Native. Supports HBC 40 to 99. Install Pre-built binaries Linux / macOS / Windows from Releases or Actions: Asset suffix| Platform ---|--- linux-x8664 / linux-arm64| Linux macos-arm64 / macos-x8664| macOS windows-x8664| Windows...
CVE-2025-11953-POC-
CVE-2025-11953 - React Native CLI RCE Research Environment 📋 Overview CVE-2025-11953 is a critical Remote Code Execution RCE vulnerability in the React Native CLI's Metro development server discovered by JFrog Security. This research environment provides the actual vulnerable implementation for...
CyberPup
CyberPup A free, open-source cybersecurity app for everyday people. CyberPup helps non-technical users lock down their digital lives through guided checklists, bite-sized lessons, and tools like breach checking. All guidance is grounded in well-known frameworks from ACSC, CISA, and NIST -...
CVE-2025-11953-PoC
Description The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and r...
reproducer-okio-cve-2023-3635
reproducer-okio-cve-2023-3635 What this reproduces Reproducer for facebook/react-native58148: React Native's own packages/react-native/gradle/libs.versions.toml pins okhttp = "4.9.2" / okio = "2.9.0", and okio 2.9.0 is affected by CVE-2023-3635 / GHSA-w33c-445m-f8w7, fixed in okio 3.4.0. No app...
React Native Community CLI - Unauthenticated OS Command Injection
The Metro development server started by the React Native Community CLI binds to external network interfaces by default and exposes an unauthenticated /open-url endpoint. Affected versions pass the attacker supplied url value straight to the open helper without validating the scheme, allowing an...
CVE-2024-25466
CVE-2024-25466 Description for CVE-2024-25466 Suggested description Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the Android library component. Vulnerability Type...
Malicious code in intercom-react-native-example-e2e-tests (RubyGems)
Source: ossf-package-analysis f17f130fc5b4fa9192f15a6e914928336f4e591d424b5bec8696923519d2793f The OpenSSF Package Analysis project identified 'intercom-react-native-example-e2e-tests' @ 1.0.1 rubygems as malicious. It is considered malicious because: - The package communicates with a domain...
MAL-2026-18462 Malicious code in intercom-react-native-example-e2e-tests (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f17f130fc5b4fa9192f15a6e914928336f4e591d424b5bec8696923519d2793f The OpenSSF Package Analysis project identified 'intercom-react-native-example-e2e-tests' @ 1.0.1 rubygems as malicious. It is considered...
Malicious code in intercom-react-native-example-e2e-tests (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57e084aff68cdd6201d55d3375bbc29f6e741553d4ac083f910fc38e110ef3d1 The gem declares ext/mkrfconf.rb as an extension script, so it runs automatically on gem install. The script collects host reconnaissance data...
Malware in react-native-drago-callkit
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
MAL-2026-18394 Malicious code in react-native-drago-callkit (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6482c5b9acc843621591425f84d7a79b5d1aef6d5c71f88c9d02074aa73afc6a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in react-native-drago-callkit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9df4250c447fe422966a254b974db832e444643ae8a106e29266ef04e55a51b Package react-native-drago-callkit at version 0.0.0-stage ships only two files and exhibits no observable installer-harm behavior. There are no...
Malicious code in react-native-bright-sdk (npm)
Source: amazon-inspector 4208eebeabe05114e68e0b4abf11c9ff176594200c28400fe5c82deb3a5c8f55 The package declares a preinstall lifecycle hook that executes canary.js on npm install. The script collects os.hostname and an install timestamp, base64-encodes the JSON payload, and transmits it via HTTPS...
Malicious Package
Overview react-native-bright-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...
MAL-2026-18290 Malicious code in react-native-bright-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4208eebeabe05114e68e0b4abf11c9ff176594200c28400fe5c82deb3a5c8f55 The package declares a preinstall lifecycle hook that executes canary.js on npm install. The script collects os.hostname and an install timestamp,...
Malicious code in react-native-bright-sdk (npm)
react-native-bright-sdk 9000.0.0 is a dependency-confusion package that squats the name of a React Native SDK that is distributed privately as a tarball outside the npm registry. Its preinstall script runs node canary.js, which collects the machine's hostname and a timestamp, base64-encodes them...
