{"id":"GHSA-399j-vxmf-hjvr","summary":"@react-native-community/cli has arbitrary OS command injection","details":"The Metro Development Server, which is opened by the React Native CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.","aliases":["CVE-2025-11953"],"modified":"2026-02-05T21:49:39.769167Z","published":"2025-11-03T18:31:52Z","database_specific":{"github_reviewed_at":"2025-11-06T17:28:29Z","nvd_published_at":"2025-11-03T17:15:32Z","cwe_ids":["CWE-78"],"severity":"CRITICAL","github_reviewed":true},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11953"},{"type":"WEB","url":"https://github.com/react-native-community/cli/issues/2733#issuecomment-3502424164"},{"type":"WEB","url":"https://github.com/react-native-community/cli/pull/1615"},{"type":"WEB","url":"https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547"},{"type":"WEB","url":"https://github.com/react-native-community/cli/commit/5a792169d9883e0b0fb1ddf1ea46778f21510d18"},{"type":"WEB","url":"https://github.com/react-native-community/cli/commit/9e1fa8cc633e5dcf32244ffa60a871880be56722"},{"type":"WEB","url":"https://github.com/react-native-community/cli/commit/a8293dc29425f56249753507bc24d87b698d46e1"},{"type":"PACKAGE","url":"https://github.com/react-native-community/cli"},{"type":"WEB","url":"https://github.com/react-native-community/cli/releases/tag/v20.0.0"},{"type":"WEB","url":"https://github.com/react-native-community/cli?tab=readme-ov-file#compatibility"},{"type":"WEB","url":"https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability"},{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11953"},{"type":"WEB","url":"https://www.vulncheck.com/blog/metro4shell_eitw"},{"type":"WEB","url":"https://x.com/SzymonRybczak/status/1986199665000566848"},{"type":"WEB","url":"https://x.com/szymonrybczak/status/1986199665000566848?s=46"},{"type":"WEB","url":"https://x.com/thymikee/status/1986770875954475375"}],"affected":[{"package":{"name":"@react-native-community/cli","ecosystem":"npm","purl":"pkg:npm/%40react-native-community/cli"},"ranges":[{"type":"SEMVER","events":[{"introduced":"20.0.0-alpha.0"},{"fixed":"20.0.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-399j-vxmf-hjvr/GHSA-399j-vxmf-hjvr.json"}},{"package":{"name":"@react-native-community/cli","ecosystem":"npm","purl":"pkg:npm/%40react-native-community/cli"},"ranges":[{"type":"SEMVER","events":[{"introduced":"19.0.0-alpha.0"},{"fixed":"19.1.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-399j-vxmf-hjvr/GHSA-399j-vxmf-hjvr.json"}},{"package":{"name":"@react-native-community/cli","ecosystem":"npm","purl":"pkg:npm/%40react-native-community/cli"},"ranges":[{"type":"SEMVER","events":[{"introduced":"18.0.0"},{"fixed":"18.0.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-399j-vxmf-hjvr/GHSA-399j-vxmf-hjvr.json"}},{"package":{"name":"@react-native-community/cli-server-api","ecosystem":"npm","purl":"pkg:npm/%40react-native-community/cli-server-api"},"ranges":[{"type":"SEMVER","events":[{"introduced":"20.0.0-alpha.0"},{"fixed":"20.0.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-399j-vxmf-hjvr/GHSA-399j-vxmf-hjvr.json"}},{"package":{"name":"@react-native-community/cli-server-api","ecosystem":"npm","purl":"pkg:npm/%40react-native-community/cli-server-api"},"ranges":[{"type":"SEMVER","events":[{"introduced":"19.0.0-alpha.0"},{"fixed":"19.1.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-399j-vxmf-hjvr/GHSA-399j-vxmf-hjvr.json"}},{"package":{"name":"@react-native-community/cli-server-api","ecosystem":"npm","purl":"pkg:npm/%40react-native-community/cli-server-api"},"ranges":[{"type":"SEMVER","events":[{"introduced":"18.0.0"},{"fixed":"18.0.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-399j-vxmf-hjvr/GHSA-399j-vxmf-hjvr.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}