1077 matches found
cve-2025-11953-vulnerability-demo
React Native CLI Command Injection Demo CVE-2025-11953 ⚠️ VULNERABILITY DEMONSTRATION ⚠️ JFSA-2025-001495618 - Critical Command Injection in React Native CLI CVE : CVE-2025-11953 CVSS Score : 9.8 Critical Affected Package : @react-native-community/cli-server-api Vulnerable Versions : 4.8.0, 20.0.0...
CVE-2025-11953-POC-
CVE-2025-11953 - React Native CLI RCE Research Environment 📋 Overview CVE-2025-11953 is a critical Remote Code Execution RCE vulnerability in the React Native CLI's Metro development server discovered by JFrog Security. This research environment provides the actual vulnerable implementation for...
hermes-decomp
Rust decompiler for Hermes bytecode .hbc, the JS engine behind React Native. Supports HBC 40 to 99. Install Pre-built binaries Linux / macOS / Windows from Releases or Actions: Asset suffix| Platform ---|--- linux-x8664 / linux-arm64| Linux macos-arm64 / macos-x8664| macOS windows-x8664| Windows...
CyberPup
CyberPup A free, open-source cybersecurity app for everyday people. CyberPup helps non-technical users lock down their digital lives through guided checklists, bite-sized lessons, and tools like breach checking. All guidance is grounded in well-known frameworks from ACSC, CISA, and NIST -...
CVE-2024-25466
CVE-2024-25466 Description for CVE-2024-25466 Suggested description Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the Android library component. Vulnerability Type...
CVE-2025-11953-PoC
Description The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and r...
Malicious code in react-native-drago-callkit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9df4250c447fe422966a254b974db832e444643ae8a106e29266ef04e55a51b Package react-native-drago-callkit at version 0.0.0-stage ships only two files and exhibits no observable installer-harm behavior. There are no...
Malware in react-native-drago-callkit
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
reproducer-okio-cve-2023-3635
reproducer-okio-cve-2023-3635 What this reproduces Reproducer for facebook/react-native58148: React Native's own packages/react-native/gradle/libs.versions.toml pins okhttp = "4.9.2" / okio = "2.9.0", and okio 2.9.0 is affected by CVE-2023-3635 / GHSA-w33c-445m-f8w7, fixed in okio 3.4.0. No app...
React Native Community CLI - Unauthenticated OS Command Injection
The Metro development server started by the React Native Community CLI binds to external network interfaces by default and exposes an unauthenticated /open-url endpoint. Affected versions pass the attacker supplied url value straight to the open helper without validating the scheme, allowing an...
Malicious code in react-native-bright-sdk (npm)
Source: amazon-inspector 4208eebeabe05114e68e0b4abf11c9ff176594200c28400fe5c82deb3a5c8f55 The package declares a preinstall lifecycle hook that executes canary.js on npm install. The script collects os.hostname and an install timestamp, base64-encodes the JSON payload, and transmits it via HTTPS...
Malicious Package
Overview react-native-bright-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...
MAL-2026-18290 Malicious code in react-native-bright-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4208eebeabe05114e68e0b4abf11c9ff176594200c28400fe5c82deb3a5c8f55 The package declares a preinstall lifecycle hook that executes canary.js on npm install. The script collects os.hostname and an install timestamp,...
Malicious code in react-native-bright-sdk (npm)
react-native-bright-sdk 9000.0.0 is a dependency-confusion package that squats the name of a React Native SDK that is distributed privately as a tarball outside the npm registry. Its preinstall script runs node canary.js, which collects the machine's hostname and a timestamp, base64-encodes them...
CLSA-2026-1792595229 TuxCare security update for @react-native-community/cli-platform-android (1 CVE)
TuxCare rebuilt @react-native-community/cli-platform-android to address 1 CVE. Fixed in 13.5.1-tuxcare.1...
CLSA-2026-1792256009 TuxCare security update for @react-native-community/cli-server-api (1 CVE)
TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 13.6.9-tuxcare.3...
CLSA-2026-1792256007 TuxCare security update for @react-native-community/cli-server-api (1 CVE)
TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 13.6.8-tuxcare.1...
CLSA-2026-1792256008 TuxCare security update for @react-native-community/cli-server-api (1 CVE)
TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 13.5.1-tuxcare.1...