React Native Community CLI - Unauthenticated OS Command Injection

The Metro development server started by the React Native Community CLI binds to external network interfaces by default and exposes an unauthenticated /open-url endpoint. Affected versions pass the attacker supplied url value straight to the open helper without validating the scheme, allowing an...

MAL-2026-15525 Malicious code in amplitude-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 489592652dd724254e29c10536019e0e03e8032e781748a73fc357bb40f50a1d package.json declares a single dependency whose source is a bare HTTPS URL https://repo.securityctrl.com/amplitude-react-native rather than a registr...

CVE-2025-11953-PoC

الوصف خادم التطوير Metro، الذي يفتحه واجهة أوامر React Native Community CLI، يرتبط بالواجهات الخارجية افتراضيًا. يعرّض الخادم نقطة نهاية معرضة لحقن أوامر نظام التشغيل. وهذا يسمح لمهاجمي الشبكة غير المصادق عليهم بإرسال طلب POST إلى الخادم وتشغيل ملفات تنفيذية عشوائية. على نظام Windows، يمكن...

CVE-2025-11953-POC-

CVE-2025-11953 - Ambiente di Ricerca RCE per React Native CLI 📋 Panoramica CVE-2025-11953 è una vulnerabilità critica di Esecuzione Remota di Codice RCE nel server di sviluppo Metro della React Native CLI, scoperta da JFrog Security. Questo ambiente di ricerca fornisce l'implementazione reale...

CVE-2024-25466

CVE-2024-25466 Descrizione per CVE-2024-25466 Descrizione suggerita Vulnerabilità di Directory Traversal in React Native Document Picker precedente alla v.9.1.1 e corretta nella v.9.1.1 consente a un attaccante locale di eseguire codice arbitrario tramite uno script appositamente predisposto nel...

reproducer-okio-cve-2023-3635

reproducer-okio-cve-2023-3635 Cosa riproduce questo progetto Reproducer per facebook/react-native58148: il file packages/react-native/gradle/libs.versions.toml di React Native fissa okhttp = "4.9.2" / okio = "2.9.0", e okio 2.9.0 è affetto da CVE-2023-3635 / GHSA-w33c-445m-f8w7, corretta in okio...

mhf

Mobile Helper Framework è uno strumento che automatizza il processo di identificazione del framework/tecnologia utilizzato per creare un'applicazione mobile. Inoltre, aiuta a trovare informazioni sensibili o fornisce suggerimenti per lavorare con la piattaforma identificata. Come funziona? Lo...

hermes-decomp

Rust decompiler for Hermes bytecode .hbc, the JS engine behind React Native. Supports HBC 40 to 99. Install Pre-built binaries Linux / macOS / Windows from Releases or Actions: Asset suffix| Platform ---|--- linux-x8664 / linux-arm64| Linux macos-arm64 / macos-x8664| macOS windows-x8664| Windows...

CyberPup

CyberPup Eine kostenlose, quelloffene Cybersicherheits-App für den Alltag. CyberPup hilft nicht-technischen Nutzern, ihr digitales Leben mit geführten Checklisten, häppchenweisen Lektionen und Werkzeugen wie der Überprüfung auf Datenlecks zu sichern. Alle Anleitungen basieren auf bekannten...

cve-2025-11953-vulnerability-demo

React Native CLI Command Injection Demo CVE-2025-11953 ⚠️ SCHWACHSTELLENDEMONSTRATION ⚠️ JFSA-2025-001495618 - Kritische Befehlseinschleusung in der React Native CLI CVE : CVE-2025-11953 CVSS-Score : 9.8 Kritisch Betroffenes Paket : @react-native-community/cli-server-api Verwundbare Versionen :...

MAL-2026-13495 Malicious code in blekit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce64fb8d6264bfc9affaf6b3544637cb8559b232075b70a48144e5f1c1743020 blekit is published as a React Native BLE SDK, but its main entry re-exports a logger module consoleApp/initializeLogger/getCurrentStatus from...

Malicious code in react-native-ui-message (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 615dd38493e2ff2257cfe5fe94b089a9001329b0d68c6b48f7ac491e4fcb205f [email protected] declares a postinstall hook that runs src/utilities/SubscriptionGuard.js. On install the script enumerates non-internal...

Malicious code in @qlik/react-native-simple-grid (npm)

npm/@qlik/react-native-simple-grid is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11769 Malicious code in @ornikar/react-native-svg-transformer (npm)

npm/@ornikar/react-native-svg-transformer is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojaniz...

CLSA-2026-1778114659 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 11 @react-native-community packages to address 1 CVE. Fixed in 12.3.7-tuxcare.1...

CLSA-2026-1778114660 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 11 @react-native-community packages to address 1 CVE. Fixed in 13.6.9-tuxcare.1...

CLSA-2026-1777941835 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 11 @react-native-community packages to address 1 CVE. Fixed in 11.4.1-tuxcare.1...

CLSA-2026-1778114661 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 13 @react-native-community packages to address 1 CVE. Fixed in 15.1.3-tuxcare.1...

MAL-2026-7366 Malicious code in react-native-paysafe-apple-pay (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-6869 Malicious code in react-native-template-my-starter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 30bd4589f0bb5751d014ac29303e8f4675751cead4ddad316ec33f7cc46051b9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...