CVE-2025-11953
CriticalExploitedPublic exploit@react-native-community/cli has arbitrary OS command injection
Published Nov 3, 2025 · Updated Aug 12, 2026 · Also known as GHSA-399j-vxmf-hjvr
Key Facts
Patch immediately- CVE-2025-11953 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting React Native Community Cli (React-Native-Community), @react-native-community/cli (npm), @react-native-community/cli-server-api (npm).
- It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Dec 21, 2025. Public exploit code is available.
- EPSS estimates a 94% probability of exploitation in the next 30 days.
- Fixed versions are available, including @react-native-community/cli 18.0.1, @react-native-community/cli 19.1.2, @react-native-community/cli 20.0.0.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
94%
Higher than 99.8% of all scored CVEs
Exploited in the wild
Yes
4 catalog listings
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2025-11953 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CISA KEV | Feb 5, 2026 | Feb 26, 2026 | Not reported |
| Industry KEV feed | Dec 21, 2025 | Feb 26, 2026 | Not reported |
| CIRCL KEV | Feb 5, 2026 | Feb 26, 2026 | Not reported |
| ENISA EUVD | Feb 5, 2026 | n/a | Not reported |
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected Products
8 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| React Native Community CliReact-Native-Community | 18.0.0, 20.0.0-alpha0, 20.0.0-alpha1, 20.0.0-alpha2 | 19.1.2 |
| @react-native-community/clinpm | >= 20.0.0-alpha.0 | 20.0.0 |
| @react-native-community/cli-server-apinpm | >= 20.0.0-alpha.0, >= 4.8.0 | 20.0.0 |
Patched Releases
@react-native-community/cli
18.0.1, 19.1.2, 20.0.0
@react-native-community/cli-server-api
18.0.1, 19.1.2, 20.0.0
React Native Community Cli
19.1.2
Timeline
Publicly disclosed
Nov 3, 2025
Added to Industry KEV feed
Dec 21, 2025
Added to CISA KEV
Feb 5, 2026
Added to CIRCL KEV
Feb 5, 2026
Added to ENISA EUVD
Feb 5, 2026
Last updated
Aug 12, 2026
Weakness Type
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
References
- advisoryGHSA advisory
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11953.json
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2025-11953
- exploitVulnCheck exploitation report
- exploitVulnCheck exploitation report
FAQ
Common Questions.
The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default.
Affected: React Native Community Cli (React-Native-Community) versions 18.0.0, 20.0.0-alpha0, 20.0.0-alpha1, 20.0.0-alpha2; @react-native-community/cli (npm) versions >= 20.0.0-alpha.0; @react-native-community/cli-server-api (npm) versions >= 20.0.0-alpha.0, >= 4.8.0. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Dec 21, 2025.
Yes. It was added on Feb 5, 2026 with a federal remediation due date of Feb 26, 2026.
Public exploit code is available.
Fixed versions are available, including @react-native-community/cli 18.0.1, @react-native-community/cli 19.1.2, @react-native-community/cli 20.0.0.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2025-11953 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo