VULNERABILITY INTELLIGENCE

CVE-2025-11953

CVSS score9.8 CRITICAL
EPSS probability93.98%
CISA KEVKnown exploited vulnerability
Published2025-11-03
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

React Native Community CLI OS Command Injection Vulnerability

Vendor / product: React Native Community / CLI

Description

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.

Weakness classification

  • reefs@jfrog.com: CWE-78

Primary references