CVE-2025-11953

What it actually does

The React Native Community CLI starts a Metro Development Server that binds to external network interfaces by default. A vulnerable unauthenticated HTTP POST endpoint can pass attacker-controlled input into operating-system process execution. A remote network attacker who can reach the Metro server can cause the Node.js/Metro process to run arbitrary executables; on Windows, the issue can allow arbitrary shell command execution with attacker-controlled arguments. Successful exploitation provides code execution with the privileges of the user running the development server and can lead to full confidentiality, integrity, and availability compromise of that workstation, build host, or development environment.

Why it matters to the business

This is a high-urgency issue because it is remotely exploitable without authentication, has a CVSS score of 9.8, has active exploitation reported in the wild, has a high EPSS score of 0.61921, and is listed in CISA KEV with a remediation due date of 2026-02-26. Exposed development servers can become an entry point for source-code theft, credential theft, malware deployment, build pipeline compromise, and lateral movement into internal systems. Although not currently marked as used in ransomware campaigns, the capability is suitable for post-compromise tooling, persistence, and data exfiltration. Organizations with React Native development, shared dev hosts, CI runners, remote workstations, or incorrectly exposed port 8081 services should treat this as an immediate remediation priority.

How an attack unfolds

An attacker first identifies a reachable Metro Development Server, commonly by scanning for React Native/Metro responses on development ports such as 8081 or by probing known Metro status and debugger endpoints. Because the server may bind to non-loopback interfaces by default, the attacker does not need local access if network controls allow inbound connections. The attacker then sends a crafted unauthenticated POST request to the vulnerable server endpoint with input designed to be interpreted as an executable or command invocation. The Metro/React Native CLI process passes that input to the operating system, causing attacker-selected code to run under the account that launched the development server. After execution, the attacker may download additional tooling, read local project files and secrets, harvest tokens from developer machines, modify application code, pivot to source-control or CI/CD systems, or establish persistence. Windows targets are especially exposed because the vulnerability can permit arbitrary shell commands with controlled arguments.

How to fix it

Upgrade React Native Community CLI to a fixed release or a version containing the upstream fixes. For source-based pinning, ensure react-native-community/cli includes fixed commits 29ec42ba6938220f035049304f02cef0da230ea9 and/or 15089907d1f1301b22c72d7f68846a2ef20df547 as applicable to the maintained branch. Review package-lock.json, yarn.lock, pnpm-lock.yaml, and monorepo dependency pins to ensure vulnerable CLI packages are not retained transitively. If using vendor-packaged software listed in advisories, apply the relevant fixed packages, including Red Hat Enterprise Linux 6 Firefox/firefox-debuginfo builds fixed in 0:60.9.0-1.el6_10 where applicable to that advisory stream. As immediate mitigation, prevent Metro from listening on external interfaces; bind it to localhost only, block inbound access to Metro development ports such as 8081 at host and network firewalls, and prohibit exposure through VPN split-tunnel, port forwarding, containers, cloud security groups, or development tunnels. Do not run Metro as an administrative/root user. If exposure is suspected, rotate developer credentials, source-control tokens, package registry tokens, mobile signing credentials, cloud credentials, and any secrets accessible to the affected user account.

How to confirm the fix worked

Confirm all React Native projects and developer tooling resolve to a fixed React Native Community CLI version or include the fixed commits in the checked-out dependency. Validate lockfiles and installed node_modules contents rather than relying only on package.json ranges. From a separate host, verify that Metro development servers are not reachable on external interfaces and that TCP port 8081 is blocked except where explicitly required. Where Metro must run, confirm it binds only to 127.0.0.1 or ::1. Use safe, non-exploitative checks such as requesting the Metro status endpoint from an unauthorized network segment and confirming it is denied or unreachable. Review EDR/process telemetry to confirm the Metro Node.js process does not spawn unexpected shell interpreters, download utilities, scripting engines, or administrative tools. For Red Hat-packaged entries in the provided affected-product metadata, confirm installed RPM versions are at or above 0:60.9.0-1.el6_10 where those packages are in scope.

Typical attack path

1. Scan internal or internet-facing address ranges for Metro/React Native development servers, especially services listening on TCP port 8081.
2. Confirm a Metro server is reachable by requesting benign Metro endpoints such as status, debugger, or bundle-related paths.
3. Send an unauthenticated crafted POST request to the vulnerable command-execution endpoint.
4. Cause the Metro server’s Node.js process to spawn an attacker-selected executable or shell command.
5. Run discovery commands to identify the user context, project directory, operating system, credentials, tokens, and network reachability.
6. Download or execute follow-on tooling, exfiltrate source code or secrets, and attempt lateral movement to developer, source-control, or build infrastructure.
7. Cover tracks by deleting temporary files or relying on the limited default logging often present in local development servers.

How to detect it

To determine whether exploitation already occurred, combine network, web, and endpoint telemetry because Metro development servers often have limited application logging. Search firewall, proxy, VPN, cloud flow, EDR network, and packet-capture data for non-localhost connections to Metro ports, especially TCP 8081, followed by HTTP POST requests to React Native/Metro endpoints. Review developer workstation, CI runner, and container process-creation telemetry for node or node.exe spawning unexpected child processes such as cmd.exe, powershell.exe, pwsh.exe, wscript.exe, cscript.exe, mshta.exe, sh, bash, curl, wget, python, perl, nc, ncat, or certutil. On Windows, inspect Sysmon Event ID 1, Security 4688, PowerShell 4103/4104, and Defender/EDR command-line telemetry for child processes of node.exe. On Linux/macOS, inspect auditd, osquery, shell history, EDR process events, and system logs for child processes of node, npm, yarn, pnpm, or react-native. Review Metro/terminal output, development server logs, reverse-proxy logs, and container logs for unexpected POST requests, remote client IPs, or command execution errors. Look for downloaded payloads in temporary directories, modified project files, new persistence entries, unexpected SSH keys, suspicious npm lifecycle script changes, new launch agents/services, and unusual outbound connections after Metro requests. If threat-intel references name this activity as React Native Community CLI OS Command Injection Vulnerability exploitation, correlate its timing with scans and process execution originating from the Metro process.

• TCP port 8081 exposed to non-localhost clients
• POST /open-url
• POST /open-stack-frame
• POST /launch-js-devtools
• POST /symbolicate
• GET /status
• GET /debugger-ui
• GET /json/list
• node.exe -> cmd.exe
• node.exe -> powershell.exe
• node.exe -> pwsh.exe
• node.exe -> wscript.exe
• node.exe -> cscript.exe
• node.exe -> mshta.exe
• node.exe -> certutil.exe
• node.exe -> curl.exe
• node.exe -> wget.exe
• node -> /bin/sh
• node -> /bin/bash
• node -> curl
• node -> wget
• node -> python
• node -> perl
• node -> nc
• node -> ncat
• node -> chmod
• node -> osascript
• Metro waiting on
• Welcome to Metro
• React Native packager is running

What your security team should do

• Immediately inventory systems running React Native Metro Development Server or React Native Community CLI, including developer workstations, CI runners, containers, remote dev environments, and shared build hosts.
• Prioritize any Metro service reachable from non-localhost networks, VPN clients, cloud networks, or the internet because exploitation is unauthenticated and active in the wild.
• Upgrade React Native Community CLI to a fixed version containing commits 29ec42ba6938220f035049304f02cef0da230ea9 or 15089907d1f1301b22c72d7f68846a2ef20df547, and refresh lockfiles across repositories.
• Enforce host firewall or endpoint-management policy blocking inbound access to Metro ports such as 8081 except from localhost.
• Add EDR/SIEM detections for Node.js or Metro spawning shells, scripting engines, download utilities, credential tools, or persistence mechanisms.
• Hunt historical logs and endpoint telemetry for suspicious POST requests to Metro endpoints and unusual child processes from node/node.exe.
• If any exposed vulnerable server is found, treat the host as potentially compromised: collect forensic evidence, isolate if warranted, rotate secrets, and review source-code and CI/CD activity.
• Track CISA KEV remediation expectations and complete remediation before the 2026-02-26 due date.