Junglewise Threat Intelligence

CVE-2025-11953: React Native Community CLI arbitrary OS command injection

CVE-2025-11953 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2025-11-03

Technologies: React Native Community CLI. Vendors: React Native Community.

Executive brief

The React Native CLI's Metro development server exposes a network-accessible endpoint that fails to properly validate user input, allowing unauthenticated attackers to inject and execute arbitrary operating system commands. This affects developers running the CLI locally with the default network binding enabled, potentially giving attackers the ability to take control of the development machine, steal source code, inject malicious code into the application, or use the compromised system as a pivot point for further attacks.

Technical details

The vulnerability exists in the openURLMiddleware component of @react-native-community/cli-server-api, which handles POST requests to the /open-url endpoint. The middleware failed to properly validate the URL scheme, allowing attackers to specify custom URI schemes (including file://, command://, or other protocol handlers) instead of restricting to http/https only. An unauthenticated attacker on the network can send a specially crafted POST request with malicious URI data to trigger execution of arbitrary executables. On Windows systems, attackers achieve complete shell command execution with fully controlled arguments. The fix involved adding stricter URL validation to reject non-HTTP(S) schemes before the URL is passed to the system's URL handler. Patches are available in versions 18.0.1, 19.1.2, and 20.0.0 of @react-native-community/cli and @react-native-community/cli-server-api.

Affected products

  • React Native Community @react-native-community/cli 18.0.0–18.0.0, 19.0.0-alpha.0–19.1.1, 20.0.0-alpha.0–20.0.0-rc.x
  • React Native Community @react-native-community/cli-server-api 18.0.0–18.0.0, 19.0.0-alpha.0–19.1.1, 20.0.0-alpha.0–20.0.0-rc.x

Timeline

  • 2025-11-03: disclosed: Vulnerability published as GHSA-399j-vxmf-hjvr and CVE-2025-11953
  • 2025-11-06: patched: Security patches released in versions 18.0.1, 19.1.2, and 20.0.0
  • exploited: Known to be exploited in the wild; documented as Metro4Shell

References