CVE-2025-11953-PoC

Descripción El servidor de desarrollo Metro, que es abierto por la CLI de React Native Community, se vincula a interfaces externas por defecto. El servidor expone un endpoint que es vulnerable a la inyección de comandos del sistema operativo. Esto permite que atacantes de red no autenticados enví...

mhf

Mobile Helper Framework es una herramienta que automatiza el proceso de identificar el framework/tecnología utilizado para crear una aplicación móvil. Además, ayuda a encontrar información sensible o brinda sugerencias para trabajar con la plataforma identificada. ¿Cómo funciona? La herramienta...

hermes-decomp

Descompilador en Rust para bytecode de Hermes .hbc, el motor JS detrás de React Native. Compatible con HBC 40 a 99. Instalación Binarios precompilados Linux / macOS / Windows desde Releases o Actions: Sufijo del asset| Plataforma ---|--- linux-x8664 / linux-arm64| Linux macos-arm64 / macos-x8664|...

React Native Community CLI - Unauthenticated OS Command Injection

The Metro development server started by the React Native Community CLI binds to external network interfaces by default and exposes an unauthenticated /open-url endpoint. Affected versions pass the attacker supplied url value straight to the open helper without validating the scheme, allowing an...

CLSA-2026-1790884245 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 13.6.9-tuxcare.3...

reproducer-okio-cve-2023-3635

reproducer-okio-cve-2023-3635 What this reproduces Reproducer for facebook/react-native58148: React Native's own packages/react-native/gradle/libs.versions.toml pins okhttp = "4.9.2" / okio = "2.9.0", and okio 2.9.0 is affected by CVE-2023-3635 / GHSA-w33c-445m-f8w7, fixed in okio 3.4.0. No app...

CLSA-2026-1790879434 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 13.5.1-tuxcare.1...

CLSA-2026-1790878902 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 13.6.8-tuxcare.1...

CLSA-2026-1790878081 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 3 @react-native-community packages to address 1 CVE. Fixed in 12.0.0-alpha.15-tuxcare.1...

CLSA-2026-1790877670 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 3 @react-native-community packages to address 1 CVE. Fixed in 12.0.0-alpha.17-tuxcare.1...

CLSA-2026-1790877607 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 12.3.6-tuxcare.1...

CLSA-2026-1790871357 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 12.3.2-tuxcare.1...

CLSA-2026-1790870094 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 12.3.0-tuxcare.1...

CLSA-2026-1790869390 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 8 @react-native-community packages to address 1 CVE. Fixed in 5.0.1-tuxcare.1...

CVE-2025-11953-POC-

CVE-2025-11953 - React Native CLI RCE Research Environment 📋 Overview CVE-2025-11953 is a critical Remote Code Execution RCE vulnerability in the React Native CLI's Metro development server discovered by JFrog Security. This research environment provides the actual vulnerable implementation for...

CLSA-2026-1790866461 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 3 @react-native-community packages to address 1 CVE. Fixed in 2.0.2-tuxcare.1...

CVE-2024-25466

CVE-2024-25466 Descripción para CVE-2024-25466 Descripción sugerida La vulnerabilidad de Directory Traversal en React Native Document Picker anterior a v.9.1.1 y corregida en v.9.1.1 permite a un atacante local ejecutar código arbitrario mediante un script manipulado en el componente de la librer...

CyberPup

CyberPup Una aplicación de ciberseguridad gratuita y de código abierto para personas comunes. CyberPup ayuda a usuarios no técnicos a proteger su vida digital mediante listas de verificación guiadas, lecciones breves y herramientas como la verificación de filtraciones. Toda la orientación se basa...

cve-2025-11953-vulnerability-demo

Demostración de Inyección de Comandos en la CLI de React Native CVE-2025-11953 ⚠️ DEMOSTRACIÓN DE VULNERABILIDAD ⚠️ JFSA-2025-001495618 - Inyección Crítica de Comandos en la CLI de React Native CVE : CVE-2025-11953 Puntuación CVSS : 9.8 Crítico Paquete Afectado :...

CVE-2026-97724

A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing a proto property to modify the prototype of an object created during serialization in clonePlainJSObject in...