CVE-2025-11953-POC-

CVE-2025-11953 - React Native CLI RCE 연구 환경 📋 개요 CVE-2025-11953은 JFrog Security가 발견한 React Native CLI의 Metro 개발 서버에서 발생하는 치명적인 원격 코드 실행RCE 취약점입니다. 이 연구 환경은 방어적 보안 연구, 탐지 개발, 완화 테스트를 위한 실제 취약한 구현을 제공합니다. CVSS 점수: 9.8 치명적 영향받는 버전: @react-native-community/cli-server-api v4.8.0 – v20.0.0-alpha.2 수정된...

cve-2025-11953-vulnerability-demo

React Native CLI 명령 주입 데모 CVE-2025-11953 ⚠️ 취약점 데모 ⚠️ JFSA-2025-001495618 - React Native CLI의 심각한 명령 주입 CVE : CVE-2025-11953 CVSS 점수 : 9.8 심각 영향을 받는 패키지 : @react-native-community/cli-server-api 취약한 버전 : 4.8.0, 20.0.0 발견 : JFrog Security Research Team 취약점 요약 React Native CLI가 열어놓는 Metro 개발 서버는...

Hackers Exploit Metro4Shell RCE Flaw in React Native CLI npm Package

Threat actors have been observed exploiting a critical security flaw impacting the Metro Development Server in the popular "@react-native-community/cli" npm package. Cybersecurity company VulnChecksaid it first observed exploitation of CVE-2025-11953 aka Metro4Shell on December 21, 2025. With a...

Severe React Native Flaw Exposes Developer Systems to Remote Attacks

JFrog researchers found a critical RCE vulnerability CVE-2025-11953 in the popular React Native CLI. Developers using versions 4.8.0-20.0.0-alpha.2 must update to patch the flaw...

Exploit for CVE-2025-11953

React Native CLI Command Injection Demo CVE-2025-11953 ⚠...

Critical React Native CLI Flaw Exposed Millions of Developers to Remote Attacks

Details have emerged about a now-patched critical security flaw in the popular "@react-native-community/cli" npm package that could be potentially exploited to run malicious operating system OS commands under certain conditions. "The vulnerability allows remote unauthenticated attackers to easily...

CVE-2025-11953

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary...

CVE-2025-11953

The CVE-2025-11953 issue affects the React Native Community CLI Server API Node.js Package (versions 4.8.0 up to, but not including, 20.0.0). The Metro Development Server bound to external interfaces exposes an endpoint vulnerable to OS command injection, enabling unauthenticated network attacker...

CVE-2025-11953 Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary...

React Native Community CLI 安全漏洞

React Native Community CLI is an open source command line tool for React Native Community. A security vulnerability exists in the React Native Community CLI, which stems from a default binding to an external interface and an OS command injection vulnerability in the endpoint, which could allow an...

PT-2025-44787

Name of the Vulnerable Software and Affected Versions React Native Community CLI versions 4.8.0 through 20.0.0-alpha.2 Description The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint vulnerable to...