# CVE-2025-11953: React Native Community CLI arbitrary OS command injection

Source: https://junglewise.ai/threats/cve-2025-11953-react-native-community-cli-os-command-injection-in-metro-dev  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-11953 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2025-11-03

The React Native CLI's Metro development server exposes a network-accessible endpoint that fails to properly validate user input, allowing unauthenticated attackers to inject and execute arbitrary operating system commands. This affects developers running the CLI locally with the default network binding enabled, potentially giving attackers the ability to take control of the development machine, steal source code, inject malicious code into the application, or use the compromised system as a pivot point for further attacks.

Technologies: [React Native Community CLI](https://junglewise.ai/threats/technologies/cli). Vendors: [React Native Community](https://junglewise.ai/threats/vendors/react-native-community).

## Quick answers

**Is CVE-2025-11953 exploited in the wild?** Yes. CVE-2025-11953 is known to be exploited in the wild, first recorded on 5 February 2026. Treat it as urgent.

**How severe is CVE-2025-11953?** Critical severity, with a CVSS score of 3.1, published 3 November 2025.

**Which products and versions are affected?** React Native Community CLI Server API >= 18.0.0, < 18.0.1; >= 19.0.0, < 19.1.2; >= 20.0.0-alpha.0, < 20.0.0; React Native Community React Native CLI 4.8.0 to < 19.1.2, 20.0.0-alpha.0 to 20.0.0-alpha.2.

**Is there a fix for CVE-2025-11953?** A patch was published on 2025-11-06: Security patches released in versions 18.0.1, 19.1.2, and 20.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-11953 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-11953?** Check whether you run React Native Community CLI, React Native Community CLI Server API or React Native Community React Native CLI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the openURLMiddleware component of @react-native-community/cli-server-api, which handles POST requests to the /open-url endpoint. The middleware failed to properly validate the URL scheme, allowing attackers to specify custom URI schemes (including file://, command://, or other protocol handlers) instead of restricting to http/https only. An unauthenticated attacker on the network can send a specially crafted POST request with malicious URI data to trigger execution of arbitrary executables. On Windows systems, attackers achieve complete shell command execution with fully controlled arguments. The fix involved adding stricter URL validation to reject non-HTTP(S) schemes before the URL is passed to the system's URL handler. Patches are available in versions 18.0.1, 19.1.2, and 20.0.0 of @react-native-community/cli and @react-native-community/cli-server-api.

## Affected products

- React Native Community @react-native-community/cli 18.0.0–18.0.0, 19.0.0-alpha.0–19.1.1, 20.0.0-alpha.0–20.0.0-rc.x
- React Native Community @react-native-community/cli-server-api 18.0.0–18.0.0, 19.0.0-alpha.0–19.1.1, 20.0.0-alpha.0–20.0.0-rc.x

## Identifiers

- CVE-2025-11953
- GHSA-399j-vxmf-hjvr

## Timeline

- 2025-11-03: disclosed: Vulnerability published as GHSA-399j-vxmf-hjvr and CVE-2025-11953
- 2025-11-06: patched: Security patches released in versions 18.0.1, 19.1.2, and 20.0.0
- exploited: Known to be exploited in the wild; documented as Metro4Shell

## References

- [https://github.com/react-native-community/cli/issues/2733](https://github.com/react-native-community/cli/issues/2733)
- [https://github.com/react-native-community/cli/pull/1615](https://github.com/react-native-community/cli/pull/1615)
- [https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547](https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547)
- [https://github.com/react-native-community/cli/commit/5a792169d9883e0b0fb1ddf1ea46778f21510d18](https://github.com/react-native-community/cli/commit/5a792169d9883e0b0fb1ddf1ea46778f21510d18)
- [https://github.com/react-native-community/cli/commit/9e1fa8cc633e5dcf32244ffa60a871880be56722](https://github.com/react-native-community/cli/commit/9e1fa8cc633e5dcf32244ffa60a871880be56722)
- [https://github.com/react-native-community/cli/commit/a8293dc29425f56249753507bc24d87b698d46e1](https://github.com/react-native-community/cli/commit/a8293dc29425f56249753507bc24d87b698d46e1)