React Native Community CLI - Unauthenticated OS Command Injection

Exploited in the wild. Listed by CISA on 2026-02-05; known to be used by ransomware.

criticalseverity

9.8CVSS score

94%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

The Metro development server started by the React Native Community CLI binds to external network interfaces by default and exposes an unauthenticated /open-url endpoint. Affected versions pass the attacker supplied url value straight to the open() helper without validating the scheme, allowing an unauthenticated attacker to launch arbitrary executables on the developer machine. On Windows the request is dispatched through cmd, which permits arbitrary shell commands with fully controlled arguments. The fix was released as a backport across several release lines, so the version number alone does not indicate whether an instance is affected, and this template probes the endpoint behaviour instead.

Impact

An unauthenticated attacker with network access to the bundler port can execute arbitrary programs on a developer workstation, leading to compromise of the development environment along with any source code and credentials held on it.

Fix

Upgrade @react-native-community/cli-server-api to 17.0.1, 18.0.1, 19.1.2 or 20.0.0 and later, whichever is the fixed release for the line in use. Where upgrading is not immediately possible, bind the Metro development server to the loopback interface with --host 127.0.0.1 and block inbound access to the bundler port.

How to confirm it

Send: GET /status
Positive when: status_code == 200 and contains(body, "packager-status:running") and contains(to_lower(header), "x-react-native-project-root")
Send: POST /open-url
Positive when: status_code == 200 and len(body) == 0 and !contains(body, "Invalid URL")

Run it with nuclei: nuclei -id CVE-2025-11953 -u <target>

The full check

id: CVE-2025-11953

info:
  name: React Native Community CLI - Unauthenticated OS Command Injection
  author: aryu-ru
  severity: critical
  description: |
    The Metro development server started by the React Native Community CLI binds to external network interfaces by default and exposes an unauthenticated /open-url endpoint. Affected versions pass the attacker supplied url value straight to the open() helper without validating the scheme, allowing an unauthenticated attacker to launch arbitrary executables on the developer machine. On Windows the request is dispatched through cmd, which permits arbitrary shell commands with fully controlled arguments. The fix was released as a backport across several release lines, so the version number alone does not indicate whether an instance is affected, and this template probes the endpoint behaviour instead.
  impact: |
    An unauthenticated attacker with network access to the bundler port can execute arbitrary programs on a developer workstation, leading to compromise of the development environment along with any source code and credentials held on it.
  remediation: |
    Upgrade @react-native-community/cli-server-api to 17.0.1, 18.0.1, 19.1.2 or 20.0.0 and later, whichever is the fixed release for the line in use. Where upgrading is not immediately possible, bind the Metro development server to the loopback interface with --host 127.0.0.1 and block inbound access to the bundler port.
  reference:
    - https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability/
    - https://www.vulncheck.com/blog/metro4shell_eitw
    - https://github.com/advisories/GHSA-399j-vxmf-hjvr
    - https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547
    - https://nvd.nist.gov/vuln/detail/CVE-2025-11953
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-11953
    epss-score: 0.9398
    epss-percentile: 0.99846
    cwe-id: CWE-78
  metadata:
    verified: true
    max-request: 2
    vendor: react-native-community
    product: react_native_community_cli
    fofa-query: title="React Native" && port="8081"
  tags: cve,cve2025,react-native,metro,rce,unauth,intrusive,kev,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /status HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "packager-status:running")'
          - 'contains(to_lower(header), "x-react-native-project-root")'
        condition: and
        internal: true

  - raw:
      - |
        POST /open-url HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"url":"nuclei-probe://{{randstr}}"}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'len(body) == 0'
          - '!contains(body, "Invalid URL")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from