CVE-2025-11953: Critical RCE in React Native CLI’s Metro Dev Server

CVE-2025-11953 represents a critical remote code execution vulnerability with a CVSS score of 9.8, affecting the React Native Community CLI’s Metro development server through an OS command injection flaw.

Vulnerability Overview

This issue stems from an exposed HTTP endpoint in the @react-native-community/cli-server-api package, versions 4.8.0 through 20.0.0-alpha.2, which processes unsanitized user input via the open() function from the open NPM package.Attackers can send crafted POST requests to endpoints like /open-url, injecting arbitrary OS commands that execute on the host running the Metro dev server. The server binds to external interfaces by default, making it accessible over the local network without authentication.

Technical Breakdown

Classified as CWE-78 (OS Command Injection), the flaw allows unauthenticated exploitation where attacker-controlled data from URL parameters or request bodies directly feeds into command execution. On Windows, full shell command control is possible; macOS and Linux limit to executable launches with partial argument manipulation.Exploitation requires only network reachability to the dev server, common in development environments or misconfigured CI/CD pipelines.

Potential Impact

Compromise yields arbitrary code execution on developer workstations or build agents, risking credential theft, source code exfiltration, malware persistence, and pivoting into corporate networks. Multiple CERTs, including INCIBE and national agencies, issued alerts, with WAF vendors deploying emergency rules due to its high exploitability.As a supply chain risk in React Native ecosystems, it amplifies threats to mobile app development pipelines.

Detection Steps

Verify exposure by checking installed versions:

• Run npm list @react-native-community/cli-server-api in project directories for local installs.
• Use npm list -g @react-native-community/cli-server-api for global packages.

Versions in the 4.8.0 to 20.0.0-alpha.2 range confirm vulnerability, especially if Metro binds beyond localhost.

Remediation Guide

• Immediate Fix: Upgrade to @react-native-community/cli-server-api 20.0.0 or later, which enforces strict URL validation limiting to safe schemes like http and https.
• Workaround: Bind Metro to localhost via npx react-native start --host 127.0.0.1 or equivalent in package.json scripts.
• Hardening: Deploy firewall rules or WAF protections blocking unauthorized access to Metro endpoints; audit CI environments for exposed dev servers.

Organizations using React Native should prioritize patching, as this zero-day-like flaw drew rapid vendor response post-disclosure in early November 2025.