CVE-2025-11953-PoC

Description The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and r...

hermes-decomp

Rust decompiler for Hermes bytecode .hbc, the JS engine behind React Native. Supports HBC 40 to 99. Install Pre-built binaries Linux / macOS / Windows from Releases or Actions: Asset suffix| Platform ---|--- linux-x8664 / linux-arm64| Linux macos-arm64 / macos-x8664| macOS windows-x8664| Windows...

mhf

Mobile Helper Framework est un outil qui automatise le processus d'identification du framework/technologie utilisé pour créer une application mobile. De plus, il aide à trouver des informations sensibles ou fournit des suggestions pour travailler avec la plateforme identifiée. Comment ça marche ?...

React Native Community CLI - Unauthenticated OS Command Injection

The Metro development server started by the React Native Community CLI binds to external network interfaces by default and exposes an unauthenticated /open-url endpoint. Affected versions pass the attacker supplied url value straight to the open helper without validating the scheme, allowing an...

CLSA-2026-1790884245 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 13.6.9-tuxcare.3...

reproducer-okio-cve-2023-3635

reproducer-okio-cve-2023-3635 What this reproduces Reproducer for facebook/react-native58148: React Native's own packages/react-native/gradle/libs.versions.toml pins okhttp = "4.9.2" / okio = "2.9.0", and okio 2.9.0 is affected by CVE-2023-3635 / GHSA-w33c-445m-f8w7, fixed in okio 3.4.0. No app...

CLSA-2026-1790879434 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 13.5.1-tuxcare.1...

CLSA-2026-1790878902 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 13.6.8-tuxcare.1...

CLSA-2026-1790878081 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 3 @react-native-community packages to address 1 CVE. Fixed in 12.0.0-alpha.15-tuxcare.1...

CLSA-2026-1790877670 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 3 @react-native-community packages to address 1 CVE. Fixed in 12.0.0-alpha.17-tuxcare.1...

CLSA-2026-1790877607 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 12.3.6-tuxcare.1...

CLSA-2026-1790871357 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 12.3.2-tuxcare.1...

CLSA-2026-1790870094 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 12.3.0-tuxcare.1...

CLSA-2026-1790869390 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 8 @react-native-community packages to address 1 CVE. Fixed in 5.0.1-tuxcare.1...

CVE-2025-11953-POC-

CVE-2025-11953 - React Native CLI RCE Research Environment 📋 Overview CVE-2025-11953 is a critical Remote Code Execution RCE vulnerability in the React Native CLI's Metro development server discovered by JFrog Security. This research environment provides the actual vulnerable implementation for...

CLSA-2026-1790866461 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 3 @react-native-community packages to address 1 CVE. Fixed in 2.0.2-tuxcare.1...

CVE-2024-25466

CVE-2024-25466 Description for CVE-2024-25466 Suggested description Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the Android library component. Vulnerability Type...

CyberPup

CyberPup A free, open-source cybersecurity app for everyday people. CyberPup helps non-technical users lock down their digital lives through guided checklists, bite-sized lessons, and tools like breach checking. All guidance is grounded in well-known frameworks from ACSC, CISA, and NIST -...

cve-2025-11953-vulnerability-demo

React Native CLI Command Injection Demo CVE-2025-11953 ⚠️ VULNERABILITY DEMONSTRATION ⚠️ JFSA-2025-001495618 - Critical Command Injection in React Native CLI CVE : CVE-2025-11953 CVSS Score : 9.8 Critical Affected Package : @react-native-community/cli-server-api Vulnerable Versions : 4.8.0, 20.0.0...

CVE-2026-97724

A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing a proto property to modify the prototype of an object created during serialization in clonePlainJSObject in...