CVE-2025-11953: React Native Community CLI OS Command Injection Vulnerability

React Native Community CLI contains an OS command injection vulnerability that affects the Metro Development Server. Unauthenticated network attackers can send POST requests to a vulnerable endpoint and execute arbitrary executables. On Windows the same flaw permits execution of shell commands with fully controlled arguments. The issue matters because development servers are frequently left reachable during builds and testing, giving an attacker a direct path to run code on developer or build systems.

How it works

The weakness is classified as CWE-78, improper neutralization of special elements used in an OS command. An attacker supplies input that is concatenated into a command string executed by the operating system. In this case the input arrives via an unauthenticated POST request to an endpoint exposed by the Metro Development Server.

On Windows the injected data can reach the command interpreter with attacker-controlled arguments, allowing execution of arbitrary programs or scripts. The flaw does not require authentication or prior access to the development machine.

Am I affected? How to find it in your systems

React Native Community CLI and its Metro Development Server are used in local and CI-based React Native workflows. Inventory every workstation, build server, and container image that installs or runs the CLI package.

• Search package manifests and lockfiles for the React Native Community CLI dependency.
• Scan running processes and network listeners for the Metro bundler on development or build hosts.
• Review firewall rules, container port mappings, and VPN configurations that allow inbound connections to development ports.
• Examine logs for unexpected POST requests to Metro endpoints from external addresses.

Confirm exact affected versions and exposure conditions against the vendor advisory before declaring systems safe.

How to remediate

Apply the vendor update referenced in the official advisory. After patching, restrict the Metro Development Server to localhost or to explicitly authorized build agents only. Enforce network segmentation so that development tooling ports are not reachable from general user or internet-facing networks. Validate that any custom scripts or wrappers around the CLI do not re-introduce command concatenation patterns.

If you can't patch immediately

Block inbound access to Metro ports at the host firewall or network boundary until the update is deployed. Disable or avoid features that start the development server in shared or multi-tenant environments. Increase logging verbosity on development hosts and forward those logs to a central SIEM for detection of anomalous POST traffic. Where virtual patching or WAF rules are available, block unexpected POST methods to known Metro paths.

If your data may have been exposed

Command injection vulnerabilities that permit unauthenticated remote execution have been used to establish persistent access and exfiltrate data. Run a free exposure scan of your organization's email addresses against known breach datasets to determine whether related credentials or tokens have already appeared in public dumps.