CVE-2025-11953
Last modified
CVE-2025-11953 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. CISA has confirmed active exploitation in the wild. EPSS estimates a 61.94% chance of exploitation in the next 30 days.
Description
The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| React-Native-Community | React Native Community Cli | >= 19.0.0, < 19.1.2 | — |
| React-Native-Community | React Native Community Cli | 18.0.0 | — |
| React-Native-Community | React Native Community Cli | 20.0.0 | Alpha0 |
References
- https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerabilityExploit, Mitigation, Third Party Advisory
- https://x.com/SzymonRybczak/status/1986199665000566848Third Party Advisory
- https://x.com/thymikee/status/1986770875954475375Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11953US Government Resource
- https://www.vulncheck.com/blog/metro4shell_eitwExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-11953?
How severe is CVE-2025-11953?
How do I fix CVE-2025-11953?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-11947A weakness has been identified in bftpd up to 6.2. Impacted …4.5
- CVE-2025-11948Document Management System developed by Excellent Infotek ha…9.8
- CVE-2025-11949EasyFlow .NET and EasyFlow AiNet, developed by Digiwin, has …8.7
- CVE-2025-1195A vulnerability, which was classified as problematic, has be…5.4
- CVE-2025-11950Improper Neutralization of Input During Web Page Generation …6.1
- CVE-2025-11952Stored Cross-site Scripting (XSS) in Oct8ne Chatbot v2.3. Th…6.1
- CVE-2025-11954Cross-Site request forgery (CSRF) vulnerability in Sitemio I…8
- CVE-2025-11955Incorrect validation of OCSP certificates vulnerability in T…8.2
- CVE-2025-11956Improper Neutralization of Input During Web Page Generation …8.9
- CVE-2025-11957Improper authorization in the temporary access workflow of D…9
- CVE-2025-11958An improper input validation in the Security Dashboard ignor…5.1
- CVE-2025-11959Files or Directories Accessible to External Parties, Exposur…8.1
Are you affected by CVE-2025-11953?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST